Example: SCEP client configuration with Fortinet SCEP server

In this example configuration, we will configure the EX15 device as a SCEP client that will connect to a Fortinet SCEP server.

Fortinet configuration

On the Fortinet server:

  1. Enable ports for SCEP services:
    1. From the menu, select Network > Interfaces.
    2. Select the appopriate port and click Edit.
    3. For Access Rights > Services, enable the following services:
      • HTTPS > SCEP
      • HTTPS > CRL Downloads
      • HTTP > SCEP
      • HTTP > CRL Downloads
    4. The remaining fields can be left at their defaults or changed as appropriate.
    5. Click OK.
  2. Create a Certificate Authority (CA):
    1. From the menu, click Certificate Authorities > Local CAs.
    2. Click Create New.
    3. Type a Certificate ID for the CA, for example, fortinet_example_ca.
    4. Complete the Subject Information fields.
    5. The remaining fields can be left at their defaults or changed as appropriate.
    6. Click OK.
  3. Edit SCEP settings:
    1. From the menu, click SCEP > General.
    2. Click Enable SCEP if it is not enabled.
    3. For Default enrollment password, enter a password. The password entered here must correspond to the challenge password configured for the SCEP client on the EX15 device.
    4. The remaining fields can be left at their defaults or changed as appropriate.
    5. Click OK.
  4. Create an Enrollment Request:
    1. From the menu, click SCEP > Enrollment Requests.
    2. Click Create New.
    3. For Automatic request type, select Wildcard.
    4. For Certificate authority, select the CA created in step 1, above.
    5. Complete the Subject Information fields. The Distinguished Name (DN) attributes entered here must correspond to the Distinguished Name attributes configured for the SCEP client on the EX15 device.
    6. For Renewal > Allow renewal x days before the certified is expired, type the number of days that the certificate enrollment can be renewed, prior to the request expiring. The Renewable Time setting on the EX15 device must match the setting of this parameter.
    7. The remaining fields can be left at their defaults or changed as appropriate.
    8. Click OK.

EX15 configuration

On the EX15 device:


  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Network > SCEP Client.
  4. For Add clients, enter a name for the SCEP client and click .

    The new SCEP client configuration is displayed.

  5. Click Enable to enable the SCEP client.
  6. For Renewable Time, type the number of days that the certificate enrollment can be renewed, prior to the request expiring. This value must match the setting of the Allow renewal x days before the certified is expired option on the Fortinet server.
  7. (Optional) Click Debug to enable verbose logging in /var/log/scep_client.
  8. Click to expand SCEP server.

  9. For FQDN, type the fully qualified domain name or IP address of the Fortinet server.
  10. For Password, type the challenge password. This corresponds to the Default enrollment password on the Fortinet server.
  11. Click to expand Distinguished Name.

  12. Type the value for each appropriate Distinguished Name attribute. The values entered here must correspond to the DN attributes in the Enrollment Request on the Fortinet server.
  13. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the EX15 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Add a new SCEP client, for example, Fortinet_SCEP_client:
    (config)> add network scep_client Fortinet_SCEP_client
(config network scep_client Fortinet_SCEP_client
)>
  4. Enable the SCEP client:
    (config network scep_client Fortinet_SCEP_client)> enable true
(config network scep_client Fortinet_SCEP_client)>
  5. Set the url parameter to the fully qualified domain name or IP address of the SCEP server:
    (config network scep_client Fortinet_SCEP_client)> server url https://fortinet.example.com
(config network scep_client Fortinet_SCEP_client)>
  6. Set the challenge password as configured on the SCEP server. This corresponds to the Default enrollment password on the Fortinet server.
    7. (config network scep_client Fortinet_SCEP_client)> server password challenge_password
(config network scep_client Fortinet_SCEP_client)>
  7. Set Distinguished Name attributes. The values entered here must correspond to the DN attributes in the Enrollment Request on the Fortinet server.

    1. Set the Domain Component:

      (config network scep_client Fortinet_SCEP_client)> distinguished_name dc value
(config network scep_client Fortinet_SCEP_client)>

    2. Set the two letter Country Code:

      (config network scep_client Fortinet_SCEP_client)> distinguished_name c value
(config network scep_client Fortinet_SCEP_client)>

    3. Set the State or Province:

      (config network scep_client Fortinet_SCEP_client)> distinguished_name st value
(config network scep_client  Fortinet_SCEP_client)>

    4. Set the Locality:

      (config network scep_client Fortinet_SCEP_client)> distinguished_name l value
(config network scep_client Fortinet_SCEP_client)>

    5. Set the Organization:

      (config network scep_client Fortinet_SCEP_client)> distinguished_name o value
(config network scep_client Fortinet_SCEP_client)>

    6. Set the Organizational Unit:

      (config network scep_client Fortinet_SCEP_client)> distinguished_name ou value
(config network scep_client Fortinet_SCEP_client)>

    7. Set the Common Name:

      (config network scep_client Fortinet_SCEP_client)> distinguished_name cn value
(config network scep_client Fortinet_SCEP_client)>

  8. Set the number of days that the certificate enrollment can be renewed, prior to the request expiring. This value must match the setting of the Allow renewal x days before the certified is expired option on the Fortinet server.

    (config network scep_client Fortinet_SCEP_client)> renewable_time integer
(config network scep_client Fortinet_SCEP_client)>
  9. (Optional) Enable verbose logging in /var/log/scep_client:
    (config network scep_client Fortinet_SCEP_client)> debug true
(config network scep_client Fortinet_SCEP_client)>
  10. Save the configuration and apply the change.
    (config network scep_client Fortinet_SCEP_client)> save
Configuration saved.
>
  11. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.