Repository navigation
Renew NDES SCEP certificates #22539
Description
UPDATE: @noahtalerman: Closed this request. Let's use this request instead:
Gong snippet: prospect-hubble: https://us-65885.app.gong.io/call?id=4210985230183928646&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A902%2C%22to%22%3A929%7D%5D. note that prospect-hubble uses SCEP certs, but the provider is Sectigo. Not sure if it would matter in the renewal case which certificate provider has issued the cert or if the work done to date limits us to just NDES or if it was designed to be a broad solution for all PKI providers of the SCEP protocol.
Activity
getvictor commentedon Oct 8, 2024
With the macOS
profilescommand (docs), we can't link the SCEP profile with a certificate, except by common name.getvictor commentedon Oct 11, 2024
A simple approach is to ask the user how long the certificate is issued for. We know when it is issued, so we can schedule renewal appropriately. Eventually, we would support this simple approach AND a more complex approach where we put an identifier into the common name.
I suggest we make the number of days before renewal configurable. If we are able to say that we can renew certificates every day, or even every hour, we would appeal to more security-conscious buyers, and it would make a great marketing point. cc: @spokanemac
[-]Renew SCEP certificates from Network Device Enrollment Service (NDES) [/-][+]Renew SCEP certificates[/+]noahtalerman commentedon Oct 11, 2024
Follow up to add certificate renewal for the following story:
Make this 180 days by default. Doesn't need to be configurable for now.
Pricing page: Grant Wi-Fi access (SCEP certificates)
fleetdm.com/pricing: Grant Wi-Fi access (SCEP)
fleetdm.com/pricing: Grant Wi-Fi access (SCEP) (#22900)
13 remaining items
noahtalerman commentedon Dec 6, 2024
Closed this request. Let's use this request instead:
fleet-release commentedon Dec 6, 2024
Certificate renewed,
SCEP protocol improved,
Trust in Fleet renewed.