certnanny/sscep

sscep: illegal URL https

amelroua opened this issue · 6 comments

amelroua commented

Hello,

I'm using sscep for linux client (ubuntu), I'm trying to enroll over https to NDES (ADCS) but I get this error:

sscep: illegal URL https://FQDN/certsrv/mscep/mscep.dll/pkiclient.exe?

I 'm using an SSL certificate in my NDES but I cannot find the reason of this issue.

mbartosch commented

SCEP is transported over HTTP, not HTTPS

qq8512852 commented

SCEP is transported over HTTP, not HTTPS
How to implement SCEP over HTTPS?

tedescn commented

I must agree with Martin's observation here, the design of the protocol is deliberate, where security is addressed at a message level, not the transport level. This bootstraps the need for, and secure delivery of your first certificate.

The question becomes more interesting in an HTTP/3 world, but we may be looking at alternative asymmetric key algorithms by then.

qq8512852 commented

https://www.rfc-editor.org/rfc/rfc8894.html#name-use-of-http

Thanks. As we know HTTP is not secure enough. Why don't replace it for HPPTS.

mbartosch commented

Because the SCEP RFC says so and it's stupid.

  • 👍1
  • 😄1