# DC Validation

{% hint style="warning" %}
SCEPman Enterprise Edition only
{% endhint %}

{% hint style="info" %}
These settings should only be applied to the SCEPman App Service, not the Certificate Master. Please refer to [SCEPman Settings](/scepman-configuration/application-settings.md).
{% endhint %}

## AppConfig:DCValidation:Enabled

*Linux: AppConfig\_\_DCValidation\_\_Enabled*

**Value:** *true* or *false* (default)

**Description:** This setting helps you to request Kerberos server certificates for your on-premises Domain Controllers. See [Domain Controller Certificates](/certificate-management/domain-controller-certificates.md) for details.

* **True**: SCEPman listens at the additional SCEP server endpoint with the path `/dc`. Use in conjunction with [AppConfig:DCValidation:RequestPassword](#appconfig-dcvalidation-requestpassword). 
* **False** (default): SCEPman does not issue certificates for Domain Controllers.

## AppConfig:DCValidation:RequestPassword

*Linux: AppConfig\_\_DCValidation\_\_RequestPassword*

**Value:** *String*

**Description:** A challenge password that the Domain Controllers must include in every SCEP request to acquire a certificate. Only used if AppConfig:DCValidation:Enabled is set to *true*.

We recommend defining this setting as Secret in Azure Key Vault. The Secret must have the name *AppConfig--DCValidation--RequestPassword*.

## AppConfig:DCValidation:ValidityPeriodDays

*Linux: AppConfig\_\_DCValidation\_\_ValidityPeriodDays*

**Value:** Positive *Integer*

**Description:** This setting further reduces the global ValidityPeriodDays for the Domain Controller endpoint. For example, you may define a low value like 10 days here and reduce the validity of Domain Controller certificates, while still having a long validity for your client certificates.

## AppConfig:DCValidation:EnableCertificateStorage

*Linux: AppConfig\_\_DCValidation\_\_EnableCertificateStorage*

{% hint style="info" %}
Applicable to version 2.3 and above
{% endhint %}

**Value:** *true* or *false* (default)

**Description:** When requesting certificates via the DC endpoint, SCEPman stores those requested certificates in the Storage Account in Azure if this is set to *true*. This will make the issued certificates appear in SCEPman Certificate Master, where you can view and revoke them. If set to *false*, SCEPman will not store issued certificates and the certificates are visible only in the logs or if the SCEP client stores them somewhere. If this is not set, the behavior depends on the global setting [AppConfig:EnableCertificateStorage](/scepman-configuration/application-settings/basics.md#appconfig-enablecertificatestorage).


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.scepman.com/scepman-configuration/application-settings/scep-endpoints/dc-validation.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.