Re: [PacketFence-users] [External] Re: SCEP Template / URL and MSPKI Questions

[Benn, D. <db...@cl...>]

Thank you for the response.

I added the ‘radius’ listening daemon to the main interface and restarted the services you mentioned.  Then I went into the cert template and enabled the scep server ‘null’ and restarted the PKI service.  Then I tried the url again, but the page did not respond / refused to connect as per my browser.

‘haproxy-portal’ was enabled, but not running, so I started it.  I noticed quite a few services were the same (enabled, but not running), including ones that say they are required for the config.  Is that normal / expected?

Thanks again.

From: JUSTIN BISHOP <jus...@yc...>
Sent: Monday, February 3, 2025 12:44 PM
To: pac...@li...
Cc: Benn, Davis <db...@cl...>
Subject: [External] Re: [PacketFence-users] SCEP Template / URL and MSPKI Questions

Caution: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. When in doubt, contact your IT Department

I can add some suggestions to step 3 you listed, as we have worked through the same issues.

Make sure that you add the "radius" listening daemon to your network interface on the PacketFence appliance.  This is done via Configuration > Network configuration > interfaces > select Eth0 (assuming this is your main NIC on the appliance) and select these under the "additional listening daemon(s)" dropdown.  This will require a restart of the following services:
  • haproxy-portal • httpd.portal • iptables

  Your SCEP URL should be http://<ip of PF server>/scep/<template name> - looks like you have that right.

Make sure your SCEP server is enabled under Configuration > Integration (PKI) > SCEP servers
We use the "null" entry (127.0.0.1) and make sure the shared secret matches the secret entered into the SCEP template.

On Fri, Jan 31, 2025 at 6:44 PM Benn, Davis via PacketFence-users <pac...@li...<mailto:pac...@li...>> wrote:
Hello.

I have been tinkering around with PacketFence and have some questions relating to PKI and SCEP.  For information, PacketFence is on version 14.  It is not inline and it only has one network port configured at the moment.


  1.  As per the documentation (23.1), I have configured NDES to work with PacketFence.  It seems like this only works for wireless networks?  Is there a way to do anything else with this or the MSPKI integration in general?  If not, I think for me it makes more sense to just make PacketFence a subordinate CA of my Windows CA.


  1.  How does the SCEP proxy work mentioned in the documentation (right before the SCEP test section of 23.2.2)? Is it for configuring a SCEP server to proxy to PacketFence?  What standalone SCEP servers exist that could be used with this?


  1.  I signed a CSR from the PacketFence server using my Windows CA as per (23.2.1).  I was configuring a template named IP-Phone using this CA and tried following the documentation (23.2.2), but there were a bunch of options that did not match up such as requiring an email in the template. In the template I enabled SCEP and configured a challenge password, but I have no idea what the correct url should be.  I tried http://<ipaddress>/scep/IP-Phone and that did not work. D<P-Phone%20and%20that%20did%20not%20work.%20D>o I need to enable something, or configure some sort of responder on the packetfence network interface?  I only have it set to Management at the moment.

Thank you.
_______________________________________________
PacketFence-users mailing list
Pac...@li...<mailto:Pac...@li...>
https://lists.sourceforge.net/lists/listinfo/packetfence-users