certnanny/sscep

CA Identifier switch -i not functional?

MorgusLethe opened this issue · 1 comments

Expectation: adding -i switch will tell the CA server which CA I want to work with
Issue: -i switch does nothing (does not change the GET request that sscep makes)

Details:
I am trying to query my CA server of its SCEP capabilites by using sscep getcaps -u http://[redacted]/ejbca/publicweb/apply/scep/pkiclient.exe. This does not work, adding the -v switch reveals why: the CA server does not know which CA's information I want. It says that I should add the message parameter to identify the CA to use. I suppose that the -i switch called CA Identifier in the README of sscep should do that, but it did not work.

I inspected the network packet with Wireshark, and using -i does not add anything to the URL. Here is an image:
image

If I make the following manual GET request using curl AND MAKE SURE THAT I AM ADDING THE MESSAGE PARAMETER: curl -X GET "http:[redacted]/ejbca/publicweb/apply/scep/pkiclient.exe?operation=GetCACaps&message=[redacted]" , the server correctly returns capabilites:
POSTPKIOperation
Renewal
SHA-512
SHA-256
SHA-1
DES3%

Am I misunderstanding the function of the -i switch? How do I tell sscep to identify the CA to work with?

Thank you!

I did some more tests and realized that the -i switch does work with the enroll operation. Even though the enroll operation also uses the getcaps operation (which fails in my case), the next steps work correctly and I have successfully generated a certificate. Since it used the information in the -i switch, I assume it works correctly. Thx for this software! Closing.