search

micromdm / scep

Go SCEP server
MIT License
323 stars 124 forks source link

Is it possible to configure SCEP to get certificate from Let's Encrypt? #203

Closed kasi1999999 closed 2 years ago

kasi1999999 commented 2 years ago

Hello SCEP team, is it possible to configure scep utility to act as a CA proxy - my router would be configured to use scep server for issue certificate, then the scep server would use ACME to forward it to Lets Encrypt. If it is possible, can you please provide working sample configuration? Thanks. Stefan

jessepeterson commented 2 years ago

SCEP as a proxy (sometimes called RA I think) to another CA is definitely possible and I don't know of anything that would prevent a proxy or translation to ACME. That said: there's no code built-in to do any of this. If you're willing to write code take a look at the SignCSR interface:

https://github.com/micromdm/scep/blob/699e8df4494ae17445464d664e3856fdecbc01c0/server/csrsigner.go#L11-L17

jessepeterson commented 2 years ago

Oh one other note: Let's Encrypt uses different types of challenges. Getting the SCEP to ACME translation working would require handling those challenges on behalf of the SCEP client. Seems doable but that's another element you'd have to figure out.