--- title: "How to configure OKTA SCEP CA server with Scalefusion" slug: "how-to-configure-okta-scep-ca-server-with-scalefusion" tags: ["okta scep", "okta ca server"] updated: 2024-12-19T13:50:46Z published: 2024-12-19T13:50:46Z canonical: "help.scalefusion.com/how-to-configure-okta-scep-ca-server-with-scalefusion" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt > Use this file to discover all available pages before exploring further. # How to configure OKTA SCEP CA server with Scalefusion A certificate authority server (CA server) offers a secure and user-friendly solution for creating and storing asymmetric key pairs used in public-key infrastructure (PKI), decryption, signing, and validation. Similarly, Okta's Certificate Authority (CA) server is a trusted entity that issues and manages digital certificates. Digital certificates represent a device's online identity and show ownership of public keys. Scalefusion now provides a solution for IT admins to automate certificate deployment on Windows devices by integrating Okta's SCEP-based CA server with Scalefusion. This article explains the methodology for automatically generating certificates with Okta CA Server Integration from Scalefusion Dashboard and ultimately deploying on Scalefusion-managed devices. ## Prerequisites 1. Global Admin access to Okta portal. ## How does it work? - **Step 1:** How to create the SCEP URL and Secret Key - **Step 2:** Setup OKTA SCEP CA Server - **Step 3:** Add Template(s) or the blueprints to generate a certificate - **Step 4:** Enable Template(s) from Device Profile These are explained in detail in the below sections. ## Step 1: How to create the SCEP URL and Secret Key 1. Login to your **Okta Admin portal** and navigate to **Security** > **Device Integrations** > click on **Endpoint** **Management** button. 1. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-273DXUTK.png) 2. Select the **Platform** in this screen and click on **Next**. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-03CQUNVN.png) 3. On the next page, select **Static SCEP URL** in the **SCEP URL challenge type** option and click the **Generate** button. > [!NOTE] > Note: > > As of now only the Static Challenge is supported, hence you will need to select Static SCEP URL option only. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-2R4NEC8H.png) 4. This will generate the SCEP URL and the Secret Key. Click on Save. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-AR7BO9CG.png) 5. Use these details while creating the CA server configuration (as shown in Step 2) template (as shown in Step 3) on the Scalefusion dashboard. ## Step 2: Setup OKTA SCEP CA Server To configure a Certificate server for automatic deployment of certificates: 1. On the Scalefusion Dashboard, navigate to **Device Profiles & Policies > Certificate Management** 2. Under the Certificate (CA) Servers tab, click on **Add CA Server** ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-B1AQQJAS.png) 3. This will open the Add CA Server window. Enter the following: 1. **CA Server Name:** Enter a name for the CA Server 2. **CA Server Provider:** Choose OKTA from the drop-down menu list. 3. **SCEP URL:** Provide SCEP URL that you would have created in Step 1. It is the URL to reach the Certificate Authority (CA) Server and its shared secret key 4. Click **Save.** ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-080BWDVM.png) 4. The CA server (you have added) will display as a card on the Dashboard under the Certificate (CA) Servers tab with details like active/expired certificates, certificate templates, etc. 5. Clicking on **View Details** will show the server details on the side card. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-TI3WB9MF.png) ## Step 3: Add Template Add a Template to start generating certificates using the CA server. To do so, follow these steps: 1. On the side card, click on **Create** under the Templates tab. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-MYAW5FEN.png) 2. This opens the **Add Template** window having three sections: 1. Subject 2. Subject Alternative Name 3. Certificate Type **Points to Note:** 1. **Subject** and **Subject Alternative Name** are a part of these details that need to be provided in the request. 2. The Subject is the name of the end entity for whom the certificate is being generated. 3. The certificate's **Subject info** is expected to be in a specific format called **LDAP DN** format. It works similarly to the format of a key value where each key means something. For Eg. CN=$user.email,OU=Engineering,O=Example Corp,C=US. ere, CN stands for Common Name, C is Country, O is Organization, etc. 3. **Subject:** This section allows admins to define a subject for their user-based devices and user-agnostic devices. Enter the following details: ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-7D4E0CHO.png) 1. **Template Name:** Provide a name for the template 2. For User Based Devices, enter the following in **User Based Devices** section: 1. **Subject:** The subject should be in a valid LDAP DN format. For example, CN=$user.name,CN=$user.mail,DC=com,DC=co.in. As these are user-based certificates, therefore we need to allow only $user. 2. **Alias Name:** Enter the alias name under which the certificate should be installed. 3. For User Agnostic Devices, enter the following in the **User Agnostic Devices** section: 1. **Subject:** The subject should be in a valid LDAP DN format. For example, CN=$device.name,CN=$device.imei,DC=com,DC=co.in. As these are user-agnostic certificates, therefore we need to allow only $device. 2. **Alias Name:** Enter the alias name under which the certificate should be installed. It is mandatory to enter at least one subject name 4. **Subject Alternative Name:** Keep the selection as **None** only. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-87F9J6Y5.png) 5. **Certificate Type:** From this section, admins can define the properties of the certificate 1. **Challenge / Secret Key:** Select Static from the drop-down and enter the certificate Enrollment challenge in the text box. 1. Choose **Static** from the drop-down menu list, you will have to enter the SCEP URL and Secret Key that you have created in Step 2. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-XMEXRCUM.png) 6. Once you have configured the CA server template on the Scalefusion dashboard, click **Save.** 7. The template gets created and is listed under Templates. ## Step 4: Enable certificate template from Device Profile Next step is to associate templates with Device Profiles. Once the profile is saved, a certificate is generated for the devices in the profile. Follow these steps: 1. Navigate to **Device Profiles & Policies > Device Profiles** and edit an existing Device Profile. 2. Navigate to **Certificates** section in the profile**.** 3. On the template which you want to grant access, enable the **Install** toggle. On enabling, the row will become expandable downwards. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-AIZTAA48.png) 4. Select Policy Target by choosing one of the options from the drop-down: 1. ***Device:*** When you select Device as the policy target, user certificates will be installed at the device level upon user login. 2. ***Enrolled User:*** Choosing Enrolled user as the policy target will deploy the certificate to the specific user who initially enrolled the device. 5. Once you have provided necessary grants, click on **Update Profile** 6. On the devices associated with the profile, certificates will be generated, and the apps will now be granted certificate. 7. Notice the CA server certificates that are generated will be listed under **Certificate Management** **![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1723029042285.png)** ## Actions on CA Certificates Following actions can be taken on CA certificates: 1. **Renew:** Renews the certificate on an immediate basis 2. **Deactivate / Activate:** The certificate can be deactivated or activated. If you deactivate, it will be uninstalled from the device on which it is installed. 3. **Download:** Downloads the certificate in zip format. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1723030821767.png) ## CA Certificates on device ### On Windows devices: 1. Device level CA Certificates are stored in Certificate Manager on your system. You can check and validate whether certificates are installed on the device through Certificate Manager application on your device. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1727259986041.png) 2. Enrolled User level certificates are available in Control Panel ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1727260052664.png) ### On Android devices: On Android devices, CA Certificates are stored under Settings > Security & Location > Encryption & Credentials > User Credentials. ### ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-W9NP7H9R.png) ### On iOS devices: On iOS devices, CA certificates are stored under Settings > General > VPN & Device Management > Profile > More Details. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-4MGGTAPO.png) ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-US6J5BTP.png) ### On macOS devices On macOS devices, Certificates & Templates are Visible under Privacy & Security > Others > Profiles. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-YHGZJ0C3.png) ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-EFTPC34R.png)