2

The SCEP (Simple Certificate Enrollment Protocol) is the more like the defacto protocol for device enrollment. It pushes the digital certificates to the device which can be used for authentication, and other cryptographic purposes.

Can CMP be used instead of the SCEP? Since CMP is the standard protocol to communicate with any CA that implements it, can an application residing on the device (say a mobile/laptop) use CMP to communicate with a CA to request a certificate and install it in the device which can then be used for the authentication purposes? And possible the whole life-cycle management of the device identity.

  • 1
    In short, the answer is Yes, as long as particular device implements this protocol. – Crypt32 Dec 14 '16 at 20:56
2

Yes!

Just make sure your device has a toolkit / library for communicating over the CMP protocol, and you should be good to go!

In particular, the 3GPP chose CMP as the main protocol for LTE mobile devices to request certs from a CA, update certs when they expire, and other lifecycle management operations. To facilitate the mobile device use-case, they made some additions to the CMP spec - now CMPv2 - so if your use-case needs some of the mobile-specific CMPv2 message types, then make sure you pick a CA that has CMPv2 support.

  • Do devices running android or iOS come with any default toolkit/library with the CMP support? or would it be an add-on/3rd party? Could you please provide an example or two.. – always_a_rookie_to_learn Dec 14 '16 at 21:32
  • I honestly have no idea. I would start by googling "android cmp library" / "ios cmp library" and see what comes up. If they don't support it natively in the OS, then surely there are open-source libraries on github. – Mike Ounsworth Dec 14 '16 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.