Static-AAD Validation
Last updated
Was this helpful?
Last updated
Was this helpful?
SCEPman Enterprise customers only
Linux: AppConfig__StaticAADValidation__Enabled
Value: true or false
Description: This setting helps you to request certificates from Other MDM systems, similarly to the static endpoint, but the certificates' lifetimes are bound to AAD objects (users or devices). The certificate subject has to include an AAD device ID or the Subject Alternative Name must include a user's UPN, just like for Intune certificates.
True: SCEPman listens at the additional SCEP server endpoint with the path /static/aad. Use in conjunction with .
False (default): SCEPman does not issue AAD-bound certificates for Other MDM systems.
Linux: AppConfig__StaticAADValidation__DefaultEkus
Value: Oids of the extended key usages (EKUs) that are added to the certificate if the Static AAD endpoint is used. The Oids are separated by a comma, semicolon, or space. The default is Client Authentication (1.3.6.1.5.5.7.3.2)
Description: If a certificate request does not contain any EKUs, SCEPman adds the EKUs defined in this setting to the certificate. If is set to false, the EKUs defined in this setting will be added to the certificate even if the certificate request contains EKUs.
Linux: AppConfig__StaticAADValidation__DefaultKeyUsage
Value: EncipherOnly|CrlSign|KeyCertSign|KeyAgreement|DataEncipherment|KeyEncipherment|NonRepudiation|DigitalSignature|DecipherOnly (defaults are in italic)
Linux: AppConfig__StaticAADValidation__RequestPassword
Value: String
We recommend defining this setting as Secret in Azure Key Vault. The Secret must have the name AppConfig--StaticAADValidation--RequestPassword.
Linux: AppConfig__StaticAADValidation__ValidityPeriodDays
Value: Positive Integer
Linux: AppConfig__StaticAADValidation__EnableCertificateStorage
Value: true or false (default)
Description: When requesting certificates via the Static-AAD endpoint, SCEPman stores those requested certificates in the Storage Account in Azure if this is set to true. This will make the issued certificates appear in SCEPman Certificate Master, where you can view and revoke them manually. Additionally, certificates are revoked automatically if the corresponding AAD object is disabled or deleted. If set to false or not set, SCEPman will not store issued certificates and the certificates are visible only in the logs or if the SCEP client stores them somewhere.
Description: If a certificate request does not contain a Key Usage, SCEPman adds the Key Usage defined in this setting to the certificate. If is set to false, the Key Usage defined in this setting will be added to the certificate even if the certificate request contains a Key Usage.
Description: A challenge password that a Other MDM system must include in every SCEP request to acquire a certificate. Only used if is set to true.
Description: This setting further reduces the global for the Static-AAD endpoint.