LogoLogo
LogoLogo
  • Welcome
  • Details
  • Editions
  • Use Cases
  • SCEPMAN Deployment
    • Getting Started
      • Standard Guide
      • Extended Guide
      • Scenarios
        • Certificate-based Network Authentication
        • Certificate-based Authentication for Entra ID
        • Certificate-based Authentication for RDP
    • Permissions
      • Azure App Registration
      • Managed Identities
    • Deployment Options
      • Marketplace deployment
      • Enterprise deployment
      • Terraform deployment
    • Root CA
    • Intermediate CA
  • Certificate Management
    • Revocation
    • Microsoft Intune
      • Windows
      • macOS
      • Android
      • iOS/iPadOS
      • Linux
    • Jamf Pro
      • General Configuration
      • Computers
      • Devices
      • Users
    • Other MDM Solutions
      • Google Workspace
        • ChromeOS
      • Kandji
      • Mosyle
      • SOTI MobiControl
    • Certificate Master
      • Manage Certificates
      • Certificate Signing Request (CSR)
      • TLS Server Certificate
      • TLS Inspection (Sub CA) Certificate
      • Code Signing Certificate
      • Device Certificate
      • User Certificate
    • Domain Controller Certificates
    • Enrollment REST API
      • Self Service Enrollment
        • Intune Managed Linux Client
        • Unmanaged Linux Client
      • API Enrollment
        • Linux Server
        • Windows Server
      • SCEPmanClient
  • Azure Configuration
    • Application Insights
    • App Service Sizing
      • Autoscaling
    • Custom Domain
    • Geo-Redundancy
    • Health Check
      • Using 3rd Party Monitoring
    • Log Management
    • Moving Resources
    • Private Endpoints
    • Split-Tenancy
  • Update Strategy
  • SCEPman Configuration
    • SCEPman Settings
      • Basics
      • Certificates
      • Certificate Master
      • CRL
      • Dependencies (Azure Services)
        • Azure KeyVault
        • Logging
        • Microsoft Entra ID (Azure AD)
        • National Cloud Platforms
      • Enrollment REST API
      • OCSP
      • SCEP Endpoints
        • DC Validation
        • Intune Validation
        • Jamf Validation
        • Static Validation
        • Static-AAD Validation
    • Certificate Master Settings
      • Basics
      • Microsoft Entra ID (Azure AD)
      • Logging
      • National Cloud Platforms
    • Application Artifacts
    • Certificate Master RBAC
    • Device Directories
    • Intune Strong Mapping
  • Other
    • Security & Privacy
    • Support
    • Licensing
      • Azure Marketplace
      • cleverbridge
    • FAQs
      • General
      • Certificate Connector
      • Renewing SCEPman Root CA
    • Troubleshooting
      • Common Problems
      • Certifried Security Vulnerability
      • Cisco ISE Host Header Limitation
      • Intune service discovery API permissions
      • Re-enrollment trigger
  • Uninstallation
  • Change Log
  • Links
  • SCEPman Website
Powered by GitBook
On this page
  • AppConfig:StaticValidation:Enabled
  • AppConfig:StaticValidation:DefaultEkus
  • AppConfig:StaticValidation:DefaultKeyUsage
  • AppConfig:StaticValidation:RequestPassword
  • AppConfig:StaticValidation:ValidityPeriodDays
  • AppConfig:StaticValidation:EnableCertificateStorage
  • AppConfig:StaticValidation:AllowRenewals
  • AppConfig:StaticValidation:ReenrollmentAllowedCertificateTypes

Was this helpful?

  1. SCEPman Configuration
  2. SCEPman Settings
  3. SCEP Endpoints

Static Validation

These settings should only be applied to the SCEPman App Service, not the Certificate Master. Please refer to SCEPman Settings.

AppConfig:StaticValidation:Enabled

Linux: AppConfig__StaticValidation__Enabled

Value: true or false (default)

Description: This setting helps you to request certificates from Other MDM systems (i.e. other than Intune and JAMF).

  • True: SCEPman listens at the additional SCEP server endpoint with the path /static. Use in conjunction with AppConfig:StaticValidation:RequestPassword.

  • False (default): SCEPman does not issue certificates for Other MDM systems (i.e. other than Intune and JAMF).

AppConfig:StaticValidation:DefaultEkus

Linux: AppConfig__StaticValidation__DefaultEkus

Applicable to version 2.8 and above

Value: Oids of the extended key usages (EKUs) that are added to the certificate if the Static endpoint is used. The Oids are separated by a comma, semicolon, or space. The default is Client Authentication (1.3.6.1.5.5.7.3.2)

Description: If a certificate request does not contain any EKUs, SCEPman adds the EKUs defined in this setting to the certificate. If AppConfig:UseRequestedKeyUsages is set to false, the EKUs defined in this setting will be added to the certificate even if the certificate request contains EKUs.

AppConfig:StaticValidation:DefaultKeyUsage

Linux: AppConfig__StaticValidation__DefaultKeyUsage

Applicable to version 2.8 and above

Value: EncipherOnly|CrlSign|KeyCertSign|KeyAgreement|DataEncipherment|KeyEncipherment|NonRepudiation|DigitalSignature|DecipherOnly (defaults are in italic)

Description: If a certificate request does not contain a Key Usage, SCEPman adds the Key Usage defined in this setting to the certificate. If AppConfig:UseRequestedKeyUsages is set to false, the Key Usage defined in this setting will be added to the certificate even if the certificate request contains a Key Usage.

AppConfig:StaticValidation:RequestPassword

Linux: AppConfig__StaticValidation__RequestPassword

Applicable to version 1.6 and above

Value: String

Description: A challenge password that Other MDM system must include in every SCEP request to acquire a certificate. Only used if AppConfig:StaticValidation:Enabled is set to true.

We recommend defining this setting as Secret in Azure Key Vault. The Secret must have the name AppConfig--StaticValidation--RequestPassword.

AppConfig:StaticValidation:ValidityPeriodDays

Linux: AppConfig:StaticValidation:ValidityPeriodDays

Applicable to version 1.7 and above

Value: Positive Integer

Description: This setting further reduces the global ValidityPeriodDays for the Static endpoint. For example, you may define a low value like 10 days here and reduce the validity of certificates issued over the static endpoint, while still having a long validity for your regular client certificates.

AppConfig:StaticValidation:EnableCertificateStorage

Linux: AppConfig__StaticValidation__EnableCertificateStorage

Applicable to version 2.3 and above

SCEPman Enterprise Edition only

Value: true or false (default)

Description: When requesting certificates via the static endpoint, SCEPman stores those requested certificates in the Storage Account in Azure if this is set to true. This will make the issued certificates appear in SCEPman Certificate Master, where you can view and revoke them. If set to false, SCEPman will not store issued certificates and the certificates are visible only in the logs or if the SCEP client stores them somewhere. If this is not set, the behavior depends on the global setting AppConfig:EnableCertificateStorage.

AppConfig:StaticValidation:AllowRenewals

Value: true or false (default)

Description: This allows using the RenewalReq operation on this SCEP endpoint. It works only for certificate types added to AppConfig:StaticValidation:ReenrollmentAllowedCertificateTypes.

This operation can be used with the SCEPmanClient PowerShell module.

AppConfig:StaticValidation:ReenrollmentAllowedCertificateTypes

Value: Comma-separated list of certificate types from this list:

  • DomainController

  • Static

  • IntuneUser

  • IntuneDevice

  • JamfUser

  • JamfUserWithDevice

  • JamfUserWithComputer

  • JamfDevice

  • JamfComputer

Description: You can use the SCEP endpoint for renewals of certificates of the types specified in this setting. If you do not specify any value, it defaults to no types.

For example, if you wanted to renew certificates issued manually through Certificate Master, you would specify Static. If you also want to renew Domain Controller certificates, you would specify DomainController,Static.

Last updated 2 months ago

Was this helpful?