topic SCEP with a Windows Server 2008 R2 Stand-Alone CA in Network Access Control

SCEP with a Windows Server 2008 R2 Stand-Alone CA

Marcel Maeder — Mon, 11 Mar 2019 02:57:26 GMT

Hi

Have you ever managed to set-up a Windows Server 2008 R2 CA in Stand-Alone mode with SCEP? In most howtos they are using Enterprise PKI and therefore can create certificate templates. I don't see any requests on the server and the IIS-Debugging file doesn't even get created.

I used the technet howto [1] for setting up my lab server.

[1] http://social.technet.microsoft.com/wiki/contents/articles/9063.network-device-enrollment-service-ndes-in-active-directory-certificate-services-ad-cs.aspx

Sent from Cisco Technical Support iPad App

SCEP with a Windows Server 2008 R2 Stand-Alone CA

Tarik Admani — Wed, 09 Jan 2013 19:44:04 GMT

Marcel,

Did you build this CA from scratch or are you trying to integrate an existing CA. I know when i first set this up and didnt choose enterprise the NDES configuration would not work. I am not an expert in what workarounds you can use but I had to remove the Certificate services and rebuild with enterprise.

Thanks,

Tarik Admani
*Please rate helpful posts*

Re: SCEP with a Windows Server 2008 R2 Stand-Alone CA

Marcel Maeder — Wed, 09 Jan 2013 19:58:51 GMT

Hi Tarik

I've built a new CA. I don't want to integrate it with the existing enterprise PKI because the CA should auto-grant requests. And I can't install a second Enterprise PKI with another Root-CA in the same domain. Creating an extra domain only for certificates would require topology-changes because you don't want multiple domains on the same subnet.

I'll probably use an IOS Router with the IOS CA-Feature if I don't find a solution.

Sent from Cisco Technical Support iPad App

SCEP with a Windows Server 2008 R2 Stand-Alone CA

Tarik Admani — Wed, 09 Jan 2013 20:02:00 GMT

Marcel,

Have you come across these guides:

http://technet.microsoft.com/en-us/library/ff955646%28v=ws.10%29.aspx

http://technet.microsoft.com/en-us/library/ff955646%28v=ws.10%29.aspx#BKMK_SANDES

Tarik Admani
*Please rate helpful posts*

Re: SCEP with a Windows Server 2008 R2 Stand-Alone CA

Marcel Maeder — Wed, 09 Jan 2013 20:13:31 GMT

No, I haven't seen them yet, but they're familiar to the wiki article from technet. I think that SCEP requires certificate templates which are not available in stand-alone ca.

Thank you for your reply

Sent from Cisco Technical Support iPad App

Re: SCEP with a Windows Server 2008 R2 Stand-Alone CA

Naveen Kumar — Thu, 06 Mar 2014 03:49:45 GMT

Before you configure SCEP support for BYOD, ensure that the Windows 2008 R2 NDES server has these Microsoft hotfixes installed:

Renewal request for a SCEP certificate fails in Windows Server 2008 R2 if the certificate is managed... - This issue occurs because NDES does not support the GetCACaps operation.
NDES does not submit certificate requests after the enterprise CA is restarted in Windows Server 200... - This message appears in the Event Viewer: "The Network Device Enrollment Service cannot submit the certificate request (0x800706ba). The RPC server is unavailable."

Please also check the below

Ravi Singh — Wed, 12 Mar 2014 21:51:47 GMT

Please also check the below doc with other posted.

http://technet.microsoft.com/en-us/library/cc772393%28v=ws.10%29.aspx