SCEP Certificate missing required extensions

[eh_cve_cc]

Hello,

I tried renewing our SCEP cert with our Windows certification authority and it will not upload due to error "SCEP Certificate missing required extensions". We dont use OPENSSL for our CA so the instructions and help article do not help... What are the required extensions??

[PhilipDAth]

What in Meraki land are you using SCEP for?

If you open the Certificate Template in Microsoft CA server - what are listed as the required extensions?

[eh_cve_cc]

I would guess for Wi-Fi security and authentication, but I am not sure why we are using that. Since it would make the Meraki portal a subordinate CA, i believe it would use the subordinate CA template. That one I have set to only require a common name. Systems manager has a new requirement that an additional file is icreated when the cert is generated. I created a template that has these extra settings but still no luck with the cert.

Where `configuration_file.ext` contains the following extension value pairs:

basicConstraints = critical,CA:true,pathlen:0
keyUsage = critical,keyCertSign,digitalSignature

[grgibbs]

I'm having the same issue trying to update my expired SCEP certificate. I've tried using the built-in SubCA template in ADCS as well as created new templates, but I cannot seem to get the Meraki Dashboard to accept anything signed by ADCS.

Here are the basic constraints and key usage settings in my SubCA template.

And the resulting signed certificate from the Meraki CSR:

 

 

Has anyone been able to get this working with the newer requirements and ADCS?

[grgibbs]

Okay, I was able to use the following workaround in my lab environment to update the SCEP certificate.

Using OpenSSL to sign the certificate is not ideal as that certificate would live outside of the control and knowledge of ADCS.

However, since this is just a lab environment, I was able to use the following option to extract the Root CA cert and key from my ADCS in p12 format.

https://support.citrix.com/article/CTX224970/how-to-export-internal-root-ca-with-private-key-from-mi...

I was then able to use the openssl commands in this document to extract the certificate and key in PEM format and then use OpenSSL to sign the Meraki SCEP cert.

https://www.ssl.com/how-to/export-certificates-private-key-from-pkcs12-file-with-openssl/

I doubt this option would be acceptable for a customer Production environment, but it works for my lab setup.

[PhilipDAth]

Well done.  Clever work around.