Create a Windows SCEP Profiles Policy

This policy configures Simple Certificate Enrollment Protocol (SCEP) for your Windows devices. SCEP makes issuing digital certificates easier, more secure, and scalable. 

Considerations:

• You need a Certificate Authority (CA) to issue device credentials using SCEP.
• The fields in the SCEP Profiles policy are added to the SCEP payload.

To create a Windows SCEP Profiles Policy:

1. Log in to the Jumpcloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Policy Management.
3. In the All tab, click (+).
4. On the New Policy panel, select the Windows tab.
5. Select the Windows SCEP Profiles policy from the list, then click configure.
6. (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
7. (Optional) In the Policy Notes field, enter details like when you created the policy, where you tested it, and where you deployed it.

Configure the following policy settings:

1. (Mandatory) In the CA ThumbPrint field, enter a Base64 encoded string.

2. In the Challenge field, enter the one-time pre-shared secret. 

3. In the Key Length field, select the size of the key: 1024, 2048, or 4096 bits. The default is 1024.
4. Specify the Subject Name. This should always start with CN=. 
   Example– CN=”Organization Root Authority”
   If the Subject Name value includes a leading or trailing white space or any of these characters (, = + ; / < > # ), ensure the Subject Name value is quoted. 
   Example– CN=”/C=US/O=ABCEnterprise/CN=foo/1.2.5.3=bar”

5. In the Retry Count field, enter the number of times the device should retry if the server sends a Pending response. The default is 3.
6. In the Retry Delay field, enter the number of seconds to wait between subsequent retries. The first retry is attempted without this delay. The default is 3. 
7. In the Server URL field, enter the SCEP server’s URL. For example: http://scep-server/cgi-bin/pkiclient.exe.
8. In the Name(Template Name) field, enter a unique name for the payload that’s recognised by the SCEP server. For example, WiFi Certificate.

9. In the Set Subject Alternative Name field, enter an alternate name for the SCEP certificate.
10. Select the Include Root Certificate checkbox to upload the certificate for the Certificate Authority to add to the device’s trusted anchors list.

11. (Mandatory) Enter the Renew Period value in days. The number of days must be less than the root CA expiry date.

8. Once you are done, click Save.