SCEP with a Windows Server 2008 R2 Stand-Alone CA

[Marcel Maeder]

Hi

Have you ever managed to set-up a Windows Server 2008 R2 CA in Stand-Alone mode with SCEP? In most howtos they are using Enterprise PKI and therefore can create certificate templates. I don't see any requests on the server and the IIS-Debugging file doesn't even get created.

I used the technet howto [1] for setting up my lab server.

[1] http://social.technet.microsoft.com/wiki/contents/articles/9063.network-device-enrollment-service-ndes-in-active-directory-certificate-services-ad-cs.aspx

Sent from Cisco Technical Support iPad App

[Tarik Admani]

Marcel,

Did you build this CA from scratch or are you trying to integrate an existing CA. I know when i first set this up and didnt choose enterprise the NDES configuration would not work. I am not an expert in what workarounds you can use but I had to remove the Certificate services and rebuild with enterprise.

Thanks,

Tarik Admani
*Please rate helpful posts*

[Marcel Maeder]

Hi Tarik

I've built a new CA. I don't want to integrate it with the existing enterprise PKI because the CA should auto-grant requests. And I can't install a second Enterprise PKI with another Root-CA in the same domain. Creating an extra domain only for certificates would require topology-changes because you don't want multiple domains on the same subnet.

I'll probably use an IOS Router with the IOS CA-Feature if I don't find a solution.

Sent from Cisco Technical Support iPad App

[Tarik Admani]

Marcel,

Have you come across these guides:

http://technet.microsoft.com/en-us/library/ff955646%28v=ws.10%29.aspx

http://technet.microsoft.com/en-us/library/ff955646%28v=ws.10%29.aspx#BKMK_SANDES

Tarik Admani
*Please rate helpful posts*

[Marcel Maeder]

No, I haven't seen them yet, but they're familiar to the wiki article from technet. I think that SCEP requires certificate templates which are not available in stand-alone ca.

Thank you for your reply

Sent from Cisco Technical Support iPad App

[Ravi Singh]

Please also check the below doc with other posted.

http://technet.microsoft.com/en-us/library/cc772393%28v=ws.10%29.aspx

[Naveen Kumar]

Before you configure SCEP support for BYOD, ensure that the Windows 2008 R2 NDES server has these Microsoft hotfixes installed:

• Renewal request for a SCEP certificate fails in Windows Server 2008 R2 if the certificate is managed... -  This issue occurs because NDES does not support the GetCACaps operation.
• NDES does not submit certificate requests after the enterprise CA is restarted in Windows Server 200... - This message appears in the Event Viewer: "The Network Device Enrollment Service cannot submit the certificate request (0x800706ba). The RPC server is unavailable."