SCEP Certificate missing required extensions

[Boogis]

Hello,

I tried renewing our SCEP cert with our Windows certification authority and it will not upload due to error "SCEP Certificate missing required extensions". We dont use OPENSSL for our CA so the instructions and help article do not help... What are the required extensions??

[Philip D'Ath]

What in Meraki land are you using SCEP for?

If you open the Certificate Template in Microsoft CA server - what are listed as the required extensions?

[Boogis]

I would guess for Wi-Fi security and authentication, but I am not sure why we are using that. Since it would make the Meraki portal a subordinate CA, i believe it would use the subordinate CA template. That one I have set to only require a common name. Systems manager has a new requirement that an additional file is icreated when the cert is generated. I created a template that has these extra settings but still no luck with the cert.

Where `configuration_file.ext` contains the following extension value pairs:

basicConstraints = critical,CA:true,pathlen:0
keyUsage = critical,keyCertSign,digitalSignature

[Greg Gibbs]

I'm having the same issue trying to update my expired SCEP certificate. I've tried using the built-in SubCA template in ADCS as well as created new templates, but I cannot seem to get the Meraki Dashboard to accept anything signed by ADCS.

Here are the basic constraints and key usage settings in my SubCA template.

And the resulting signed certificate from the Meraki CSR:

 

 

Has anyone been able to get this working with the newer requirements and ADCS?

[Greg Gibbs]

Okay, I was able to use the following workaround in my lab environment to update the SCEP certificate.

Using OpenSSL to sign the certificate is not ideal as that certificate would live outside of the control and knowledge of ADCS.

However, since this is just a lab environment, I was able to use the following option to extract the Root CA cert and key from my ADCS in p12 format.

https://support.citrix.com/article/CTX224970/how-to-export-internal-root-ca-with-private-key-from-microsoft-certificate-authority-services-to-use-on-netscaler-swg

I was then able to use the openssl commands in this document to extract the certificate and key in PEM format and then use OpenSSL to sign the Meraki SCEP cert.

https://www.ssl.com/how-to/export-certificates-private-key-from-pkcs12-file-with-openssl/

I doubt this option would be acceptable for a customer Production environment, but it works for my lab setup.

[Philip D'Ath]

Well done. Clever work around.

[caug1]

Sorry to resurrect this old thread, but is there any solution to this? I'm having a similar issue signing the CSR with any type of template and uploading to meraki.

[Boogis]

Did you try Grgibbs solution? We did not end up moving forward with it so I'm not sure if it works.

[Greg Gibbs]

I recently went through the process of signing the SCEP certificate for another separate lab environment and found Meraki still threw the same error when I signed it using the Intermediate CA template in ADCS.

I had to use the same workaround above with OpenSSL to get it to work.

[PriscillaX]

Hi @Boogis , thank you for raising this question!

Were you able to resolve this issue? If so, we would love to hear more about it. If not, we recommend submitting a case on our Dashboard under ? > Get Help & Cases so we can further investigate the renewal process for SCEP certificate under your SM network.

[Boogis]

No. We had given up or decided it was not worth the trouble.

If we revisit the issue, I will certainly do that. Thank you!

[esherwoo]

Since I just found this topic from the error message and managed to figure out the problem, I figured I would post the solution...

The issue with the AD subordinate cert is that it was missing pathlen:0, which is what prohibits this CA from issuing more subordinate certs. This is a cert policy construct that we can edit with a command on our Microsoft CA:

from a cmd prompt with administrative rights on your CA server run the command

> certutil -setreg Policy\CAPathLength 1

After you issue that command go and resubmit your CA request and get your cert (rename the file extension to crt) the dashboard now will accept it.

more info on

Constraints

https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/constraints-what-they-are-and-how-they8217re-used/1129048