Standard Guide
This will guide you through all steps necessary to set up SCEPman in your PoC or Production environemt based on our best practices.
Let's start with the requirements and a resource overview.
Keep in mind that you need to plan a useful Azure resource design.
- Azure subscription (at least Contributor rights on that subscription)
- Azure owner rights (at least on Resource Group level)
- Azure AD "Global administrator" (Consent to access Graph API)
- [Optional] Public Domain CNAME (scepman.yourdomain.com)
All these resources are recommended for a production environment.
Type | Description |
|---|---|
App Service(s) | A virtual Azure environment to run the SCEPman Core and Cert Master applications and provides a UI to configure different
application specific settings like CNAME, SSL certificate and App Settings. |
App Service Plan | A virtual set of compute resources and configurations for the "App Service(s)". Here you can configure the pricing tier and resource scaling. |
Key Vault | Tool to securely store secrets and certificates. The SCEPman application will generate and save the root certificate in your Key Vault. |
Application Insights | Application Performance Management (APM) tool to get insights of the SCEPman applications and requests. Needed to measure performance and good for service optimization. |
Storage account | Storage platform used by SCEPman's Cert Master component to store certain attributes of the manually issued TLS server certificates for revocation purposes.
Optional: Storage platform to upload the SCEPman artifacts and save log files. The "App Service" will load the artifacts from a public blob store URI and save all the application and web server logs in a blob container. |
Log Analytics workspace | A centralized and cloud-based log storage. The "App Service" will save all platform logs and metrics into this workspace. |
This is a mandatory step.
To start with the deployment, please follow our deployment instructions:
This is a mandatory step.
To properly link all components of SCEPman 2.X, several permissions need to be assigned. Please follow these steps to establish the relevant connections:
This is a mandatory step.
After the deployment and persmission assignment is complete, you need to create the root certificate for SCEPman:
This is an optional step.
To have your SCEPman available under your specific domain you need to create a Custom Domain in the App Service.
This is an optional step.
By default, SCEPman's update strategy is configured to the Evergreen approach / auto-updates. In case you require full control over your SCEPman updates, please configure a deployment slot as described in the following guide under section Deployment Slot Configuration.
This is recommended step.
You can configure two different logging parts in your App Service, to retain your log data. The one part is the App Service Logs, which will save all application and IIS server-based log data. The other part is the Diagnostic settings, this contains platform logs and metrics data.
Use the storage account we created in Step 4 and create two new blob containers. This blob containers can be selected in the App Service Logs instructions. In the Diagnostic settings you can directly choose the storage account and blob containers will be created automatically.
This is recommended step.
The Application Insights can be used to get an overview of the App Service performance and to get deeper insights of the request processing of SCEPman. We recommend to always configure Application Insights to monitor, maintain and optimize the App Service.
This is recommended step.
We can configure a Health Check for the App Service to get direct notifications in case that the SCEPman stops working.
This is a mandatory step.
With the completion of the above steps, we have a working SCEPman implementation and can now deploy certificates to the devices.
Please use one (or more) of the following articles, to deploy certificates with your preferred MDM solution:
This is an optional step.
Please follow below link, to learn how to issue TLS server certificates based on a list of FQDNs or sign any CSR using the Cert Master component.
Last modified 1mo ago