# Static Validation

{% hint style="info" %}
These settings should only be applied to the SCEPman App Service, not the Certificate Master. Please refer to [SCEPman Settings](https://docs.scepman.com/scepman-configuration/application-settings).
{% endhint %}

## AppConfig:StaticValidation:Enabled

*Linux: AppConfig\_\_StaticValidation\_\_Enabled*

**Value:** *true* or *false* (default)

**Description:** This setting helps you to request certificates from [Other MDM systems](https://docs.scepman.com/certificate-management/static-certificates) (i.e. other than Intune and JAMF).

* **True**: SCEPman listens at the additional SCEP server endpoint with the path `/static`. Use in conjunction with AppConfig:StaticValidation:RequestPassword. 
* **False** (default): SCEPman does not issue certificates for Other MDM systems (i.e. other than Intune and JAMF).

## AppConfig:StaticValidation:DefaultEkus

*Linux: AppConfig\_\_StaticValidation\_\_DefaultEkus*

{% hint style="info" %}
Applicable to version 2.8 and above
{% endhint %}

**Value:** Oids of the extended key usages (EKUs) that are added to the certificate if the Static endpoint is used. The Oids are separated by a comma, semicolon, or space. The default is Client Authentication (1.3.6.1.5.5.7.3.2)

**Description:** If a certificate request does not contain any EKUs, SCEPman adds the EKUs defined in this setting to the certificate. If [AppConfig:UseRequestedKeyUsages](https://docs.scepman.com/scepman-configuration/certificates#appconfig-userequestedkeyusages) is set to *false*, the EKUs defined in this setting will be added to the certificate even if the certificate request contains EKUs.

## AppConfig:StaticValidation:DefaultKeyUsage

*Linux: AppConfig\_\_StaticValidation\_\_DefaultKeyUsage*

{% hint style="info" %}
Applicable to version 2.8 and above
{% endhint %}

**Value:** EncipherOnly|CrlSign|KeyCertSign|KeyAgreement|DataEncipherment|*KeyEncipherment*|NonRepudiation|*DigitalSignature*|DecipherOnly (defaults are in *italic*)

**Description:** If a certificate request does not contain a Key Usage, SCEPman adds the Key Usage defined in this setting to the certificate. If [AppConfig:UseRequestedKeyUsages](https://docs.scepman.com/scepman-configuration/certificates#appconfig-userequestedkeyusages) is set to *false*, the Key Usage defined in this setting will be added to the certificate even if the certificate request contains a Key Usage.

## AppConfig:StaticValidation:RequestPassword

*Linux: AppConfig\_\_StaticValidation\_\_RequestPassword*

{% hint style="info" %}
Applicable to version 1.6 and above
{% endhint %}

**Value:** *String*

**Description:** A challenge password that Other MDM system must include in every SCEP request to acquire a certificate. Only used if [AppConfig:StaticValidation:Enabled](#appconfig-staticvalidation-enabled) is set to *true*.

We recommend defining this setting as Secret in Azure Key Vault. The Secret must have the name *AppConfig--StaticValidation--RequestPassword*.

## AppConfig:StaticValidation:ValidityPeriodDays

*Linux: AppConfig\_\_StaticValidation\_\_ValidityPeriodDays*

{% hint style="info" %}
Applicable to version 1.7 and above
{% endhint %}

**Value:** Positive *Integer*

**Description:** This setting further reduces the global [ValidityPeriodDays](https://docs.scepman.com/scepman-configuration/certificates#appconfig-validityperioddays) for the Static endpoint. For example, you may define a low value like 10 days here and reduce the validity of certificates issued over the static endpoint, while still having a long validity for your regular client certificates.

## AppConfig:StaticValidation:EnableCertificateStorage

*Linux: AppConfig\_\_StaticValidation\_\_EnableCertificateStorage*

{% hint style="info" %}
Applicable to version 2.3 and above

SCEPman Enterprise Edition only
{% endhint %}

**Value:** *true* or *false* (default)

**Description:** When requesting certificates via the static endpoint, SCEPman stores those requested certificates in the Storage Account in Azure if this is set to *true*. This will make the issued certificates appear in SCEPman Certificate Master, where you can view and revoke them. If set to *false*, SCEPman will not store issued certificates and the certificates are visible only in the logs or if the SCEP client stores them somewhere. If this is not set, the behavior depends on the global setting [AppConfig:EnableCertificateStorage](https://docs.scepman.com/scepman-configuration/basics#appconfig-enablecertificatestorage).

## AppConfig:StaticValidation:AllowRenewals <a href="#appconfig-dbcsrvalidation-allowrenewals" id="appconfig-dbcsrvalidation-allowrenewals"></a>

*Linux: AppConfig\_\_StaticValidation\_\_AllowRenewals*

**Value:** *true* or *false* (default)

**Description:** This allows using the *RenewalReq* operation on this SCEP endpoint. It works only for certificate types added to *AppConfig:StaticValidation:ReenrollmentAllowedCertificateTypes*.

This operation can be used with the [SCEPmanClient ](https://github.com/scepman/scepmanclient)PowerShell module.

## AppConfig:StaticValidation:ReenrollmentAllowedCertificateTypes <a href="#appconfig-dbcsrvalidation-reenrollmentallowedcertificatetypes" id="appconfig-dbcsrvalidation-reenrollmentallowedcertificatetypes"></a>

*Linux: AppConfig\_\_StaticValidation\_\_ReenrollmentAllowedCertificateTypes*

**Value:** Comma-separated list of certificate types from this list:

* DomainController
* Static
* IntuneUser
* IntuneDevice
* JamfUser
* JamfUserWithDevice
* JamfUserWithComputer
* JamfDevice
* JamfComputer

**Description:** You can use the SCEP endpoint for renewals of certificates of the types specified in this setting. If you do not specify any value, it defaults to no types.

For example, if you wanted to renew certificates issued manually through Certificate Master, you would specify `Static`. If you also want to renew Domain Controller certificates, you would specify `DomainController,Static`.