DC Validation
Last updated
Was this helpful?
Last updated
Was this helpful?
SCEPman Enterprise Edition only
Linux: AppConfig__DCValidation__Enabled
Value: true or false (default)
Description: This setting helps you to request Kerberos server certificates for your on-premises Domain Controllers. See for details.
True: SCEPman listens at the additional SCEP server endpoint with the path /dc. Use in conjunction with .
False (default): SCEPman does not issue certificates for Domain Controllers.
Linux: AppConfig__DCValidation__RequestPassword
Value: String
Description: A challenge password that the Domain Controllers must include in every SCEP request to acquire a certificate. Only used if AppConfig:DCValidation:Enabled is set to true.
We recommend defining this setting as Secret in Azure Key Vault. The Secret must have the name AppConfig--DCValidation--RequestPassword.
Linux: AppConfig__DCValidation__ValidityPeriodDays
Value: Positive Integer
Description: This setting further reduces the global ValidityPeriodDays for the Domain Controller endpoint. For example, you may define a low value like 10 days here and reduce the validity of Domain Controller certificates, while still having a long validity for your client certificates.
Linux: AppConfig__DCValidation__EnableCertificateStorage
Value: true or false (default)
Description: When requesting certificates via the DC endpoint, SCEPman stores those requested certificates in the Storage Account in Azure if this is set to true. This will make the issued certificates appear in SCEPman Certificate Master, where you can view and revoke them. If set to false, SCEPman will not store issued certificates and the certificates are visible only in the logs or if the SCEP client stores them somewhere. If this is not set, the behavior depends on the global setting .