ThinPro OS - SCEP Client

[apaloka]

Hello all, I continually receive the below error when trying to request a certificate through SCEP manager on the thin client.

HP DM is version 4.7 SP10

HP T530 is OS version T7x70015

2019-05-15 11:19:47 ErrorCode: 30720, Error Info: ../../Task/common/TaskScep.cpp@89: The ThinPro SCEP component probably only supports 1024 key length. ../../Task/common/TaskScep.cpp@88: Wed May 15 11:19:24 EDT 2019 SCEP enroll result: SCEP Client configuration error

Communication goes through fine, NDES supports 2048. SCEP Component should support higher than 1024, so not sure why this error shows. 

[apaloka]

Updating for visibility...

[DM-AJ]

You might need to update ThinPro image or the SCEP component on it to get the support for key length above 1024.

[DM-AJ]

And this error info can mean something else.  Please verify the parameters including the URL and challenge code on a sample thin client before sending a task.

[apaloka]

All of my thin clients are sample thin clients at this point, SCEP is not working with:

ThinPro OS T7X710015, T7X710018

SCEP 1024, 2048

HPDM 4.7 SP9, SP10 or 5.0

[DM-AJ]

Please take one thin client and try locally with the SCEP component to verify the configuration works before sending via an HPDM task.

[apaloka]

Sorry for not clarifying, I've done that as well. I usually try both

[DM-AJ]

1. Please confirm what status do you see on a thin client when trying to enroll.  You can find it at the bottom of the dialog of SCEP Manager as shown in the attached picture with the red box.  I guess it can be the same as what you see in the task log: 

SCEP Client configuration error

2. With NDES there is more than one URL during preparation.  Please refer to the whitepaper WP_SCEP-Tutorial_HPDM-4.7.pdf and make sure the URL is the one to enroll.  It can be like http://NDES-address/certsrv/mscep/

[apaloka]

Thanks for the help here...

I was able to push scep cert to the device. What if I want to use a machine cert here? Is there additional steps I need for this to authenticate? 

The 802.1x appears as if it's trying to work with a client cert