SCEP and OCSP - am I being able to proxy those protocols?
Dear community, I am currently faced with an decision regarding the protocols SCEP (Simple Certificate Enrollment Protocol as used by the ADCS NDES feature) and OCSP (Online Certificate Status Protocol as used by the OCSP Responder feature). I need these services to be available from a DMZ, which security is regarded lower than the internal zone (in which ADDS is located). As both features can only be installed on a member server, I'd like to place an proxy into the DMZ and then use it to proxy both protocols. Basically it's HTTP, but I am not sure, how it will work out. I took a look at the RFCs but cannot find the information I was looking for. Maybe someone can give me a clue who already tried :) Thanks for your input
July 20th, 2011 3:43am

OCSP uses plain HTTP to exchange requests and responses, this is normally not a problem if the proxy does not force additional caching time out that might result in caching expired responses. The security best practice for SECP is to enable SSL to protect the transport as it includes sensitive information, this means SECP is not as sensitive for proxying unless the proxy uses SSL inspection. /Hasain
Free Windows Admin Tool Kit Click here and download it now
July 25th, 2011 5:46am

Thanks for your answer Hasain, OCSP proved not to be a problem (this is also stated by the RFC), it is perfectly proxyable. As far as SCEP is concerned - we are currently testing and it looks good. But I think you never protect SCEP via SSL, and as far as I know, the protocol does not support SSL (except for securing the admin-page, which is plain HTML). Kind regards, MMF
July 25th, 2011 7:54am

... But I think you never protect SCEP via SSL, and as far as I know, the protocol does not support SSL (except for securing the admin-page... It is correct, the best practice I mentioned is about SSL for the admin pages please see the TechNet article http://technet.microsoft.com/en-us/library/ff955646(WS.10).aspx#BKMK_BestPractices /Hasain
Free Windows Admin Tool Kit Click here and download it now
July 25th, 2011 8:04am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics