Certificate Enrollment Profiles

Certificate enrollment profiles define the Simple Certificate Enrollment Protocol (SCEP) configuration that nodes use to obtain and renew certificates for 802.1X port-based network access control (NAC). After you create a profile, projects can reference it to enforce certificate-based authentication on managed nodes.

​

Introduction

This procedure covers how to create, edit, and delete certificate enrollment profiles. A profile specifies the SCEP server URL, certificate authority (CA), certificate signing request (CSR) parameters, and key and renewal settings. After you create a profile, you assign it to a project as part of the project’s 802.1X network access control (NAC) policy. Nodes in that project then use the profile to enroll and renew their certificates automatically.

​

Prerequisites

• You have the SysAdmin role in your enterprise. See Manage Roles.
• You have the SCEP server URL and the CA certificate in PEM format.

​

Create a Certificate Enrollment Profile

1. In the header, select your profile avatar, then select Enterprise Settings.
2. In the Enterprise Settings navigation, under Security & Access, select Network Access.
3. In the Certificate Enrollment Profiles section, select Create Profile.
4. In the Identity section, complete the following fields:

   Field	Required	Notes
   Name	Yes	Must start with a letter. Letters, numbers, hyphens, and underscores only. Minimum 2 characters. Cannot be changed after creation.
   Display Title	Yes	Human-readable label. Minimum 2 characters. Auto-populates from the Name field until you edit it directly.
   Description	No	Optional explanation of the profile’s purpose.

5. In the SCEP and Certificate Authority section, complete the following fields:

   Field	Required	Notes
   SCEP URL	Yes	The enrollment server URL, for example https://ca.example.com/scep.
   Challenge Password	No	A shared secret used by the SCEP server to authorize enrollment requests. Leave blank if your SCEP server does not require a challenge password.
   Use Edge Infrastructure Services proxy	No	When enabled, enrollment requests are routed through Edge Infrastructure Services rather than directly from the node to the SCEP server.
   CA certificate PEM	Yes	The CA certificate in PEM format. Paste the PEM text or click Upload PEM to select a .pem, .crt, or .cer file.

6. In the CSR Profile section, configure the certificate subject fields. The Common Name Template field uses {{device.serialNumber}} by default, which populates the common name with each node’s serial number at enrollment time. Adjust the Organization, Organizational Unit, Country, State, Locality, SAN URI, and SAN Email fields as required by your PKI policy. Country must be a two-letter code.
7. In the Key and Renewal section, configure the cryptographic settings:

   Field	Notes
   Key Family	RSA is the supported option. ECDSA support is planned for a future release.
   RSA Key Size	Select RSA 2048, RSA 3072, or RSA 4096. Default: RSA 2048.
   Hash Algorithm	Select SHA-256, SHA-384, or SHA-512. Default: SHA-256.
   Renewal Period (%)	The percentage of the certificate’s validity period that must elapse before renewal begins. For example, a value of 50 means renewal starts when half the certificate’s lifetime has passed. Default: 50.

8. Click Create Profile.

​

Edit a Certificate Enrollment Profile

You can edit profiles that are currently in use by one or more projects. Changes to SCEP URL, challenge password, CA certificate, or CSR settings take effect on the next certificate renewal cycle for enrolled nodes. Editing opens in a modal over the page you started from. You can start from the Certificate Enrollment Profiles list, as described in the steps that follow, or from the profile detail page by selecting the Edit button (gear icon) in the page header. Both open the same modal.

1. In the header, select your profile avatar, then select Enterprise Settings.
2. In the Enterprise Settings navigation, under Security & Access, select Network Access.
3. In the Certificate Enrollment Profiles list, select the Edit button (gear icon) in the profile row. The Edit modal opens over the list. The modal header shows the profile’s display title and, below it, the profile name.
4. Update the fields as needed. The Name field is not shown in edit mode, because the profile name is set at creation and cannot be changed. If you do not supply a new CA certificate PEM, the existing certificate material is retained.
5. Select Save Changes in the modal footer. Save Changes stays disabled until the form is valid. To close the modal without saving, select Cancel.

​

Delete a Certificate Enrollment Profile

You cannot delete a profile while it is in use by one or more projects. Remove the profile from all project NAC policies before proceeding.

1. In the Certificate Enrollment Profiles list, select the Delete button (trash icon) in the profile row. The delete button is disabled for profiles that are in use.
2. Review the confirmation message: “This action cannot be undone. Devices currently enrolled against this profile will fail to renew their certificates.”
3. Select Delete.

​

Assign a Profile to a Project

Certificate enrollment profiles take effect when they are referenced in a project’s 802.1X NAC policy.

1. Navigate to your project’s settings.
2. In the Attestation and Device Trust policy section, locate the 802.1X Port-Based Network Access Control settings.
3. Set the EAP Method to TLS.
4. Select the certificate enrollment profile from the Certificate Enrollment Profile picker.
5. Optionally, set an EAP Identity.
6. Save the project settings.

Nodes in the project begin certificate enrollment on their next check-in with Edge Infrastructure Services.

​

Verify the Configuration

After a profile is created, it appears in the Certificate Enrollment Profiles list with a Not In Use status badge. After you assign the profile to a project, the badge changes to In Use. To confirm that a specific node has enrolled successfully, navigate to the node’s detail page and locate the Enrolled Certificates section. The table shows the certificate subject, issuer, status, issue date, and expiry date. A status of Active confirms successful enrollment.

​

Next Steps