1IPSEC_SCEPCLIENT(8) IPSEC_SCEPCLIENT(8)
2
6 ipsec scepclient - Client for the SCEP protocol
7
9 ipsec scepclient [argument ...]
10 ipsec scepclient --help
12 ipsec scepclient --version
13
15 scepclient is a client implementation of Cisco System's Simple Certifi‐
16 cate Enrollment Protocol (SCEP) written for Linux strongSwan
17 <http://www.strongswan.org>. scepclient is designed to be used for
18 certificate enrollment on machines using the OpenSource IPsec solution
19 strongSwan.
20
22 scepclient implements the following features of SCEP:
23 - Automatic enrollment of client certificate using a preshared secret
25 - Manual enrollment of client certificate. Offline fingerprint check
27 required!
28 - Acquisition of CA certificate(s)
30
32 Basic Startup Options
33 -v, --version
34 Display the version of ipsec scepclient.
35 -h, --help
37 Display usage of ipsec scepclient.
38 General Options
41 -u, --url url
42 Full HTTP URL of the SCEP server to be used for certificate enroll‐
43 ment and CA certificate acquisition.
44 -+, --optionsfrom filename
46 Reads additional options from filename.
47 -f, --force
49 Overwrite existing output file[s].
50 -q, --quiet
52 Do not write log output to stderr.
53 Options for CA Certificate Acquisition
56 -o, --out cacert[=filename]
57 Output file of acquired CA certificate. If more then one CA cer‐
58 tificate is available, filename is used as prefix for the resulting
59 files (refer to EXAMPLES below for details).
60 The default filename is $CONFDIR/ipsec.d/cacerts/caCert.der.
61 Options For Certificate Enrollment
64 -i, --in type[=filename]
65 Input file for certificate enrollment. This option can be specified
66 multiple times to specify input files for every type. Input files
67 can be either DER or PEM encoded.
68 Supported values for type:
70 pkcs1 RSA private key in PKCS#1 file format. If no input of
72 this type is specified, a RSA key gets generated.
73 The default filename is $CONFDIR/ipsec.d/pri‐
74 vate/myKey.der.
75 pkcs10 PKCS#10 certificate request to be used in the SCEP
77 request. If no input of this type is specified, a
78 request is generated.
79 The default filename is $CONFDIR/ipsec.d/req/myReq.der.
80 cacert-enc CA certificate to encrypt the SCEP request. Has to be
82 specified for certificate enrollment.
83 The default filename is $CONFDIR/ipsec.d/cacerts/caC‐
84 ert.der.
85 cacert-sig CA certificate to check signature of SCEP reply. Has to
87 be specified for certificate enrollment.
88 The default filename is $CONFDIR/ipsec.d/cacerts/caC‐
89 ert.der.
90 cert-self Certificate to be used in the SCEP request. If it is
92 not specified a self-signed certificate is generated
93 automatically.
94 The default filename is $CONFDIR/ipsec.d/certs/self‐
95 Cert.der.
96 -k, --keylength bits
98 sets the key length for RSA key generation. The default length for
99 a generated rsa key is set to 2048 bit.
100 -D, --days days
102 Validity of the self-signed X.509 certificate in days. The default
103 is 1825 days (5 years).
104 -S, --startdate YYMMDDHHMMSSZ
106 defines the notBefore date when the X.509 certificate becomes
107 valid. The date has the format YYMMDDHHMMSS and must be speci‐
108 fied in UTC (Zulu time). If the --startdate option is not speci‐
109 fied then the current date is taken as a default.
110 -E, --enddate YYMMDDHHMMSSZ
112 defines the notAfter date when the X.509 certificate will expire.
113 The date has the format YYMMDDHHMMSS and must be specified in UTC
114 (Zulu time). If the --enddate option is not specified then the
115 default notAfter value is computed by adding the validity interval
116 specified by the --days option to the notBefore date.
117 -d, --dn dn
119 Distinguished name as comma separated list of relative distin‐
120 guished names. Use quotation marks for a distinguished name con‐
121 taining spaces. If the --dn parameter is missing then the default
122 "C=CH, O=Linux strongSwan, CN=hostname" is used with hostname being
123 the return value of the gethostname() function.
124 -s, --subjectAltName type=value
126 Include subjectAltName in certificate request. This option can be
127 specified multiple times to specify a subjectAltName for every
128 type.
129 Supported values for type:
131 email subjectAltName is a email address.
133 dns subjectAltName is a hostname.
135 ip subjectAltName is a IP address.
137 -p, --password pw
139 Password to be included as a challenge password in SCEP request.
140 If pw is %prompt', the password gets prompted for on the command
141 line.
142 - In automatic mode, this password corresponds to the pre‐
144 shared secret for the given enrollment.
145 - In manual mode, this password can be used to later revoke
147 the corresponding certificate.
148 -a, --algorithm [type=]algo
150 Change the algorithms to be used when generating and transporting
151 (PKCS#7) certificate requests (PKCS#10).
152 Supported values for type:
154 enc symmetric encryption algorithm in PKCS#7
156 dgst hash algorithm for message digest in PKCS#7
158 sig hash algorithm for the signature in PKCS#10
160 If type is not specified enc is assumed.
162 Supported values for algo (enc):
164 des DES-CBC encryption (key size = 56 bit). Default.
166 3des Triple DES-EDE-CBC encryption (key size = 168 bit).
168 aes128 AES-CBC encryption (key size = 128 bit).
170 aes192 AES-CBC encryption (key size = 192 bit).
172 aes256 AES-CBC encryption (key size = 256 bit).
174 camellia128 Camellia-CBC encryption (key size = 128 bit).
176 camellia192 Camellia-CBC encryption (key size = 192 bit).
178 camellia256 Camellia-CBC encryption (key size = 256 bit).
180 Supported values for algo (dgst or sig):
182 md5 (default), sha1, sha256, sha384, sha512
184 -o, --out type[=filename]
186 Output file for certificate enrollment. This option can be speci‐
187 fied multiple times to specify output files for every type.
188 Supported values for type:
190 pkcs1 RSA private key in PKCS#1 file format. If specified,
192 the RSA key used for enrollment is stored in file file‐
193 name. If none of the types listed below are specified,
194 scepclient will stop after outputting this file.
195 The default filename is $CONFDIR/ipsec.d/pri‐
196 vate/myKey.der.
197 pkcs10 PKCS#10 certificate request. If specified, the PKCS#10
199 request used or certificate enrollment is stored in
200 file filename. If none of the types listed below are
201 specified, scepclient will stop after outputting this
202 file.
203 The default filename is $CONFDIR/ipsec.d/req/myReq.der.
204 pkcs7 PKCS#7 SCEP request as it is sent using HTTP to the
206 SCEP server. If specified, this SCEP request is stored
207 in file filename. If none of types listed below is not
208 specified, scepclient will stop after outputting this
209 file.
210 The default filename is $CONFDIR/ipsec.d/req/pkcs7.der.
211 cert-self Self-signed certificate. If specified the self-signed
213 certificate is stored in file filename.
214 The default filename is $CONFDIR/ipsec.d/certs/self‐
215 Cert.der.
216 cert Enrolled certificate. This type must be specified for
218 certificate enrollment. The enrolled certificate is
219 stored in file filename.
220 The default filename is set to
221 $CONFDIR/ipsec.d/certs/myCert.der.
222 -m, --method method
224 Change HTTP request method for certificate enrollment. Default is
225 get.
226 Supported values for method:
228 post Certificate enrollment using HTTP POST. Must be sup‐
230 ported by the given SCEP server.
231 get Certificate enrollment using HTTP GET.
233 -t, --interval seconds
235 Set interval time in seconds when polling in manual mode. The
236 default interval is set to 5 seconds.
237 -x, --maxpolltime seconds
239 Set max time in seconds to poll in manual mode. The default max
240 time is set to unlimited.
241 Debugging Output Options:
244 -l, --debug level
245 Changes the log level (-1..4, default: 1)
246
248 ipsec scepclient --out caCert --url http://scepserver/cgi-bin/pki‐
249 client.exe -f
250 Acquire CA certificate from SCEP server and store it in the default
251 file $CONFDIR/ipsec.d/cacerts/caCert.der. If more then one CA cer‐
252 tificate is returned, store them in files named ´caCert-1.der´,
253 ´caCert-2.der´, etc. If an RA certificate is returned, store it in
254 a file named ´caCert-ra.der´. If more than one RA certificate is
255 returned, store them in files named ´caCert-ra-1.der´, ´caC‐
256 ert-ra-2.der´, etc.
257 ipsec scepclient --out pkcs1=joeKey.der -k 1024
259 Generate RSA private key with key length of 1024 bit and store it
260 in file joeKey.der.
261 ipsec scepclient --in pkcs1=joeKey.der --out pkcs10=joeReq.der \
263 --dn ”C=AT, CN=John Doe” -s email=john@doe.com -p mypassword
264 Generate a PKCS#10 request and store it in file joeReq.der. Use the
265 RSA private key joeKey.der created earlier to sign the
266 PKCS#10-Request. In addition to the distinguished name include a
267 email-subjectAltName and a challenge password in the request.
268 ipsec scepclient --out pkcs1=joeKey.der --out cert==joeCert.der \
270 --dn ”C=CH, CN=John Doe” -k 512 -p 5xH2pnT7wq \
271 --url http://scep.hsr.ch/cgi-bin/pkiclient.exe \
272 --in cacert-enc=caCert.der --in cacert-sig=caCert.der
273 Generate a new RSA key for the request and store it in joeKey.der.
274 Then enroll a certificate and store as joeCert.der. The challenge
275 password is '5xH2pnT7wq'. The encryption and signature check has to
276 be made with the same CA certificate caCert.der.
277
280 --optionsfrom seems to have parsing problems reading option files con‐
281 taining strings in quotation marks.
282strongSwan 2012-05-11 IPSEC_SCEPCLIENT(8)