Controller Based WLANs

Certmgr module will make use of scep application to request and download certificates from CA. Scep will be run as application and not library since the module will be used as is without changes.

1.HTTP Request

HTTP GET message is used in both GetCACert and Enroll messages sent by SCEP.
In case of Enroll request, scep does the following steps:

1. Get CSR in PKCS#10 form. (AP or controller CSR)
2. Get CA certificate used for encryption.
3. Using public key in CA certificate, encrypt the PKCS#10 blob into PKCS#7 envelope.
4. Using CSR in the PKCS#10, create a self-signed certificate.
5. Using private key of the self-signed certificate in step 4, sign the PKCS#7 envelope generated in step3 and add the certificate to this payload. (Note. Private key used for signing this PKCS#7 blob is part of the CSR that is inside the PKCS#7 blob, the same one using which we generated a self-signed certificate)
6. This is then Base64 encoded and URL encoded and sent as payload of HTTP get message to the CA.

2. HTTP Response

1. SCEP responses from CA server can be one of “Reject”, “Pending” or “Success”
2. In case of success, the request is accepted and the signed certificate is included. The signed custom certificate also comes as PKCS#7 envelope (it is called Degenerate Certificates-Only PKCS#7)
3. This PKCS#7 blob is signed by the external CA certificate. Controller will verify this since it has the CA certificate.
4. The data may be encrypted using the public key of the Cert request. Controller will decrypt it using corresponding private key and extract the certificate.

Note: SCEP   Simple Certificate Enrollment Protocol