Extended Guide

SCEPman Enterprise Edition only

This will guide you through all steps to deploy SCEPman for an enterprise-grade environment with advanced requirements, e.g. naming conventions, redundancy or auto-scaling.

Azure Deployment

Let's start with the requirements and a resource overview. Keep in mind that you need to plan a useful Azure resource design.

Prerequisites

Mandatory

• Azure resource naming convention.

• Azure subscription (at least Contributor rights on that subscription).

• Azure owner rights (at least on Resource Group level).

• Microsoft Entra ID (Azure AD) "Global administrator" (Consent to access Graph API).

• Make sure to define your Azure policies according to SCEPman requirements (e.g. do not enforce TLS).

• Public Domain CNAME (scepman.yourdomain.com), only if geo-redundancy is used.

• SSL (Wildcard-) Certificate (or use App Service Managed Certificate), only if geo-redundancy is used.

• SCEPman Enterprise Edition License Key.

Optional

• Public Domain CNAME (scepman.yourdomain.com), only if a custom domain is used.

• SSL (Wildcard-) Certificate (or use App Service Managed Certificate), only if a custom domain is used.

Overview Azure Resource

All these resources are recommended for a production environment.

Type	Description
App Service (x2)	A virtual Azure environment to run the SCEPman Core and Cert Master applications and provides a UI to configure different application specific settings like CNAME, SSL certificate and App Settings.
App Service Plan	A virtual set of compute resources and configurations for the "App Service(s)". Here you can configure the pricing tier and resource scaling.
Key Vault	Tool to securely store secrets and certificates. The SCEPman application will generate and save the root certificate in your Key Vault.
Application Insights	Application Performance Management (APM) tool to get insights of the SCEPman applications and requests. Needed to measure performance and good for service optimization.
Storage account	Storage platform used by SCEPman's Certificate Master component to store certain attributes of the manually issued TLS server certificates for revocation purposes. Optional: The "App Service" will load the artifacts from a blob storage URI if manual updates are configured.
Log Analytics workspace	A centralized and cloud-based log storage. The "App Service" will save all platform logs and metrics into this workspace.

Additionally, if you are using Private Endpoints, you have seven more Azure Resources.

Type	Description
Virtual Network	The SCEPman App Services, the Key Vault, and the Storage Account connect over this VNET.
Private Endpoint (×2)	One for the Key Vault and one for the Storage Account. It makes them accessible over the VNET.
Private DNS zone (×2)	One for the Key Vault and one for the Storage Account. They both have an internal IP address in the VNET, for which they have a name in their respective Private DNS zone.
Network Interface (×2)	One for the Key Vault and one for the Storage Account. It connects the Private Endpoint to the VNET.

Configuration Steps

Step 1: Deploy SCEPman Base Services

This is a mandatory step.

Make your choice on whether you'd like to deploy with a Windows or Linux App Service Plan. Both deployment methods will allow you to choose your Operating System.

To start with the deployment, you need to follow our setup instructions leveraging an ARM Template

Enterprise deployment

or alternatively our Terraform script:

Terraform deployment

Step 2: Perform Post-Deployment Steps (Permission Assignments)

This is a mandatory step.

To properly link all components of SCEPman, several permissions need to be assigned. Please follow these steps to establish the relevant connections:

Managed Identities

Step 3: Create Root Certificate

This is a mandatory step.

After the deployment and permission assignment is complete, you need to create the root certificate for SCEPman:

Root CA

Step 4: Configure a Custom Domain and SSL Certificate

This is a recommended step. However, skip this step if you are implementing geo-redundancy / high-availability.

To have your SCEPman available under your specific domain you need to create a Custom Domain in the App Service.

Custom Domain

Step 5: Manual Updates

This is an optional step.

By default, SCEPman adopts an evergreen approach towards updates. In case you require full control over your SCEPman updates, please configure a deployment slot as described in the following guide under section Deployment Slot Configuration.

Update Strategy

Step 6: Deploy Application Insights

This is recommended step.

The Application Insights can be used to get an overview of the App Service performance and to get deeper insights of the request processing of SCEPman. We recommend to always configure Application Insights to monitor, maintain and optimize the App Service.

Application Insights

Step 7: Configure Health Check

This is recommended step.

Health Checks can be configured to notify administrators in the event the SCEPman App Service is unresponsive.

Health Check

Step 8: Ensure that SCEPman has sufficient resources

This is a mandatory step.

Once you move SCEPman into a production environment, you should ensure that SCEPman is equipped with sufficient computing power. Therefore, please review our Azure Sizing guide and upgrade your App Service Plan tier if need be. You may postpone this until after your PoC or trial phase.

App Service Sizing

Step 9: Configure Autoscaling

This is an optional step.

The SCEPman solution has two different tasks and performance requirements. One task is the certificate issuance process: After the configuration of the SCEPman solution we need to deploy certificates to all devices (user and/or device certificates), but this is a one-time-task and after the initial deployment this only happens when a new device is enrolled, or the certificates needs to be renewed. In those situations, the SCEPman will face a peek of SCEP requests. The second task is the certificate validation: After we deployed certificates to devices, those certificates need to be validated each time we use them. For every certificated-based authentication the clients, gateways, or RADIUS system (depends on what you use) will send an OCSP request to the SCEPman App Service. This will cause a permanent request load on the App Service.

To have an optimized performance and take care of the costs we recommend to setup the Autoscaling functionality of the App Service. With this feature your application can scale-out and scale-in based on metrics.

Autoscaling

Step 10: Configure Geo-Redundancy

This is an optional step.

Geo-Redundancy

Step 11: Configure your MDM Deployment Profiles

This is a recommended step.

With the completion of the above steps, we have a working SCEPman implementation and can now deploy certificates to the devices.

Please use one (or more) of the following articles, to deploy certificates with your preferred MDM solution:

Microsoft IntuneJamf ProOther MDM Solutions

Step 12: Issue TLS Server Certificates or sign CSRs using Cert Master

This is an optional step.

Please follow below link, to learn how to issue TLS server certificates based on a list of FQDNs or sign any CSR using the Cert Master component.

Certificate Master

Step 13: Issue Certificates using the Enrollment REST API

This is an optional step.

SCEPman features a REST API to enroll certificates. This is an alternative to the SCEP endpoints that require the SCEP-style of authentication, while the REST API uses Microsoft Identities for authentication. The protocol is also much simpler than SCEP.

Enrollment REST API