1. What is the different between CMPV and SCEP protocol?
  2. Which one is better ?
  • Please share with us some of your findings. Apr 18 '14 at 18:26
  • 1
    CMP stands for Certificate Management Protocol Apr 19 '14 at 7:03

CMP is a generic protocol which aims at covering most (if not all) network exchanges involving a Certificate Authority; e.g. it includes messages for a CA who wants to announce that it has a new key pair. The protocol is rather complex, and has been around for quite some time (first published version is from 1999).

SCEP is a specialized protocol which has a smaller scope; it concentrates on enrollment and CRL obtention, and is definitely client/server (all messages are requests sent to the CA, and responses from the CA, while CMP allows for CA-driven exchanges). SCEP is not a formal standard; it is not even a RFC but still a draft which is 1. expired, and 2. destined to become an "historic" RFC. SCEP, though, is a big de facto "standard" by being what Cisco hardware tends to do.

The second paragraph of the latest SCEP draft says it all, so let me quote it in extenso:

This specification defines a protocol, Simple Certificate Enrollment Protocol (SCEP), for certificate management and certificate and CRL queries in a closed environment. While widely deployed, this protocol omits some certificate management features, e.g. in-band certificate revocation transactions, which can significantly enhance the security achieved in a PKI. The IETF protocol suite currently includes two certificate management protocols with more comprehensive functionality: Certificate Management Protocol (CMP) [RFC4210] and Certificate Management over CMS (CMC) [RFC5272]. Environments that do not require interoperability with SCEP implementations SHOULD use the above-mentioned, PKIX-standard certificate management protocols. In light of the functionality gap between this specification and the two IETF standards track protocols, this specification is being published as Historic. Even when interoperability with the installed base of SCEP implementations is needed, implementers are encouraged to support one of these comprehensive standards track certificate management protocols in addition to the protocol defined in this specification. This implementation strategy balances near-term requirements for interoperability with longer term security goals.

So there you have it: you are encouraged to support and use CMP, and you should envision SCEP mostly for compatibility with legacy deployments, and even then you know that SCEP won't do everything that can be done with CMP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.