I've been testing the SCEP server to use it with Intune for iOS/Android/Windows device enrollment, published through Entra Application Proxy (passthrough auth). GetCACaps and GetCACert both work fine through the proxy, so the base setup is solid.
The problem is on the certificate issuance step. Intune doesn't let you configure a static challenge password anywhere in the SCEP profile. Instead, Intune generates its own encrypted challenge per device and sends it along with the CSR. The SCEP server is then supposed to call back into Intune's API to validate that challenge before issuing anything.
Microsoft's docs on this:
https://learn.microsoft.com/en-us/intune/fundamentals/certificates/third-party-ca-scep
https://learn.microsoft.com/en-us/intune/fundamentals/certificates/ref-scep-api
https://learn.microsoft.com/en-us/intune/fundamentals/certificates/scep-infrastructure
From what I understand, supporting this would mean:
Registering an app in Entra with the SCEP challenge validation permission (scep_challenge_provider)
UCM calling back to Intune to validate the challenge before signing the CSR
Ideally being on Microsoft's supported third-party CA partner list, or at least implementing the same API contract
Right now I don't see anything like this in the SCEP config, only the static challenge password field. Without it, Intune enrollment will fail at the CSR/challenge step even though the rest of the SCEP flow works fine.
Is this something planned, or already possible and I'm just missing where to configure it?
Second question, separate from the above: is it possible to have multiple SCEP endpoints/URLs, each tied to a different CA or template, rather than one global SCEP endpoint for everything? My use case is that I'd like to issue different certificate types (device certs vs user certs, or different validity/EKU per device type) depending on which URL the enrollment hits, instead of having one shared endpoint that applies the same defaults to every request.
One implementation idea, in case it helps: something like pki.domain.com/scep//pkiclient.exe, where the identifier in the path maps to a specific template/CA/policy. That way each profile gets its own SCEP URL with its own challenge password and cert settings, without needing separate UCM instances.
If this already exists in some form I'd like a pointer to how, if not I'd like to put it forward as a feature request.
I've been testing the SCEP server to use it with Intune for iOS/Android/Windows device enrollment, published through Entra Application Proxy (passthrough auth). GetCACaps and GetCACert both work fine through the proxy, so the base setup is solid.
The problem is on the certificate issuance step. Intune doesn't let you configure a static challenge password anywhere in the SCEP profile. Instead, Intune generates its own encrypted challenge per device and sends it along with the CSR. The SCEP server is then supposed to call back into Intune's API to validate that challenge before issuing anything.
Microsoft's docs on this:
https://learn.microsoft.com/en-us/intune/fundamentals/certificates/third-party-ca-scep
https://learn.microsoft.com/en-us/intune/fundamentals/certificates/ref-scep-api
https://learn.microsoft.com/en-us/intune/fundamentals/certificates/scep-infrastructure
From what I understand, supporting this would mean:
Registering an app in Entra with the SCEP challenge validation permission (scep_challenge_provider)
UCM calling back to Intune to validate the challenge before signing the CSR
Ideally being on Microsoft's supported third-party CA partner list, or at least implementing the same API contract
Right now I don't see anything like this in the SCEP config, only the static challenge password field. Without it, Intune enrollment will fail at the CSR/challenge step even though the rest of the SCEP flow works fine.
Is this something planned, or already possible and I'm just missing where to configure it?
Second question, separate from the above: is it possible to have multiple SCEP endpoints/URLs, each tied to a different CA or template, rather than one global SCEP endpoint for everything? My use case is that I'd like to issue different certificate types (device certs vs user certs, or different validity/EKU per device type) depending on which URL the enrollment hits, instead of having one shared endpoint that applies the same defaults to every request.
One implementation idea, in case it helps: something like pki.domain.com/scep//pkiclient.exe, where the identifier in the path maps to a specific template/CA/policy. That way each profile gets its own SCEP URL with its own challenge password and cert settings, without needing separate UCM instances.
If this already exists in some form I'd like a pointer to how, if not I'd like to put it forward as a feature request.