scepclient: add -encryption-algorithm flag for PKCS#7 envelope - #252
Open
afterdesign wants to merge 1 commit into
Open
afterdesign wants to merge 1 commit into
afterdesign wants to merge 1 commit into
Conversation
Add a -encryption-algorithm flag to select the PKCS#7 content encryption algorithm (des|aes128|aes256|aes128gcm|aes256gcm) for the request envelope. The default stays des to preserve existing behavior; AES variants let the client interoperate with modern CAs (e.g. AWS Private CA Connector for SCEP) that reject single DES-CBC with "Unsupported algorithm: 1.3.14.3.2.7". Promote github.com/smallstep/pkcs7 to a direct dependency and document the flag in the README.
|
I'm also currently soft blocked by this exact same issue, requiring me to patch my own set of releases for compatibility with AWS SCEP Connector. I've tested this version and closed my redundant PR as it does work as expected with One thing worth noting for anyone else testing this: AWS's Connector for SCEP reliably fails the first PKIOperation of any fresh request with an unrelated |
sleventyeleven
added a commit
to sleventyeleven/Device-Trust-Cloud
that referenced
this pull request
Aug 27, 2026
Adds a second, independent Terraform root (aws/) that builds the same device trust pattern on AWS: an AWS Private CA root + intermediate CA, and AWS Private CA's fully managed Connector for SCEP as the SCEP front end - no step-ca VM or custom load balancer needed on this side, since AWS runs the SCEP protocol implementation itself. The mtls_test_gateway module is ported as-is (same nginx config, same ssl_verify_client pattern) to verify enrolled AWS-issued certificates actually work for TLS ClientAuth, matching the GCP side's own verification gateway. Getting real enrollment working required two fixes, both implemented in all three install scripts: - scepclient hardcodes DES-CBC for the SCEP request's content encryption, which AWS's Connector for SCEP rejects outright. The scripts now fetch scepclient from a patched fork (sleventyeleven/scep, tracking upstream community PR micromdm/scep#252) that adds a -encryption-algo flag, defaulting to DES-CBC so the GCP path is unaffected. - AWS's Connector for SCEP can reject a PKIOperation submitted too soon after the request's self-signed signer certificate is generated. All three scripts now retry once automatically (reusing the same cached CSR/key, not regenerating), which reliably resolves it. Also fixes two real bugs surfaced during testing against the new AWS path: install-windows.bat/install-macos.sh were still passing the old -dnsname flag after the scepclient fork picked up an upstream dnsnames/ipaddresses change, and install-windows.ps1 left -Country/-Organization/-Ou with no default, which under PowerShell's known empty-argument-dropping behavior when calling a native executable could silently shift -encryption-algo's own value out of the argument list. Restructures Readme.md to stay high-level (architecture, quick start, enrollment) with GCP-specific and AWS-specific detail, troubleshooting, and known limitations split into docs/gcp-details.md and docs/aws-details.md respectively. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new
-encryption-algorithmflag toscepclientthat selects the PKCS#7 content encryption algorithm used for the request envelope.des,aes128,aes256,aes128gcm,aes256gcm.des(single DES-CBC), so existing behavior is unchanged and this is a non-breaking, additive change.Unsupported algorithm: 1.3.14.3.2.7.Changes
cmd/scepclient/scepclient.go: add the-encryption-algorithmflag and map it topkcs7.ContentEncryptionAlgorithm.go.mod: promotegithub.com/smallstep/pkcs7to a direct dependency (already present transitively viasmallstep/scep;go.sumunchanged).README.md: document the new flag in the client help listing and add an explanatory section.Test plan
go build ./...passesgo test ./...passesgofmtclean-encryption-algorithm=aes128des) still works against an existing DES-based server