- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
How to configure Simple Certificate Enrollment Protocol (SCEP) in the SonicWall
03/26/2020 
11 People found this article helpful
47,009 Views
Description
The Simple Certificate Enrollment Protocol (SCEP) is designed to support the secure issuance of certificates to network devices in a scalable manner. There are two enrollment scenarios for SCEP:
- SCEP server CA automatically issues certificates
- SCEP request is set to PENDING and the CA administrator manually issues the certificate
In this configuration the SonicWall will act as a client and will require a SCEP server to request a certificate from. In this article we use a MS Windows Server 2008 as the SCEP server running Network Device Enrollment Service, Internet Information Services (IIS), Domain Controller and Certificate Services.
Resolution
Before beginning the SonicWall configuration, make sure the MS Windows Server 2008 has been installed with the following services:
- Certificate Authority
- Certification Authority Web Enrollment
- Network Device Enrollment Service
- Internet Information Services
For information, refer the Microsoft SCEP Implementation Whitepaper
To configure SCEP to issue certificates, follow these steps:
Generate a signing request
Obtain a Challenge Password from http://<server IP or server name>/certsrv/mscep_admin
- Scroll to the bottom of the System > Certificates page and click on the SCEP button. The SCEP Configuration window displays.
- In the CSR List pulldown menu, the UI will automatically select a default CSR list. If you have multiple CSR lists configured, you can modify this.
- In the CA URL field, enter the URL for the Certificate Authority.
- If the Challenge Password field, enter the password for the CA if one is required.
- In the Polling Interval(S) field, you can modify the default value for duration of time in seconds in between when polling messages are sent.
- In the Max Polling Time(S) field, you can modify the default value for the duration of time the firewall will wait for a response to a polling message before timing out.
- Click the Scep button to submit the SCEP enrollment.
The firewall will then contact the CA to request the certificate. The duration of time this will take depends on whether the CA issues certificates automatically or manually. The Log > View page will display messages on the status of the SCEP enrollment and issuance of the certificate. After the certificate is issued, it will be displayed in the list of available certificates on the System > Certificates page, under the Imported certificates and requests category.
Troubleshooting
- Make sure Network Device Enrollment Service is installed and started.
- Make sure the Challenge Password is the latest. Passwords are by default valid for 60 minutes.
- Make sure the IP address or domain name of the server is correct.
- Make sure the CA URL is correct.
Related Articles
- How to force an update of the Security Services Signatures from the Firewall GUI
- How to upload security services signatures manually on Closed Environments?
- How to Create Gen 7 Settings File by Using the Online Migration Tool
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
YES
NO