Deploy & renew SCEP certificates - backend #22123

Implementation plan:

• Configuration - username/password/urls
  • Credentials should be encrypted at rest in DB
  • Verify admin server when set
    • Catch the issue when NDES runs out of challenges (5 by default) -- we can parse the HTML to figure it out
  • Verify SCEP server -- issue CACerts
  • We should only verify the configuration when it changes, and not every time.
  • Obfuscated on retrieval.
  • Use best practice for clearing the setting.
  • Preprocess inputs
  • Update the errors to match Figma.
  • Delete password when clearing setting
• Challenge variable (only SCEP). Start with $FV_SCEP_CHALLENGE, $FV_SCEP_PROXY_URL, and email.
  • Get challenge from NDES server
  • If challenge cannot be retrieved, put an error into the profile verify flow.
  • (NOOP -- this simply updates DB to be picked up by cron) Allow variable insertion when profile is resent -- it can be simply resent, or resent after error.
  • Get NDES password once per run
  • Tests
  • Add error message for FLEET_VAR_ for DDM and Windows
  • Add validation of unknown variables on profile upload
  • Manually test IDP email
• Proxy -- pass through CACaps, CACerts, PKIOperation
  • Parse/retrieve profile from url path -- make sure it is present (for security)
  • [ ] Save cert expiration, and link it to SCEP profile. New table!!! This is done in nano_cert_auth_associations for MDM certs.
  • Catch error that OTP is wrong? (Need to test if we get any info for this.) If we can catch it, then push out a new profile with updated challenge. Otherwise keep track of the age of the challenge (new field? or when this profile was enqueued?). Push out a new profile when device requests a cert using an outdated challenge.
  • Tests
  • Log errors (differentiate Fleet vs SCEP server errors)
  • Clean up the new certificates table (cron job)
• Global activity feed
  • Tests
• Manual tests
  • 2 hosts with 10 profiles each
  • Setting up NDES without private key set up