Ctrlk
linkedinx-twitter
For the complete documentation index, see llms.txt. This page is also available as Markdown.

SCEPman Connection

SCEPman Connection

SCEPman Enterprise Edition only

Applicable to version 3.0 and above

The SCEPman Connection setting connects your RADIUSaaS instance directly to your SCEPman instance so that the RADIUS Server Certificate is issued and renewed automatically. Once the connection is established, RADIUSaaS will:

  1. Create and activate a new Server Certificate issued by SCEPman.

  2. Manage the lifecycle of that certificate, including its renewal.

This setting is optional. If you do not connect a SCEPman instance, you can continue to use the Customer-CA or upload your own certificate as described here.

The status badge next to the section title shows the current state of the integration: NOT CONNECTED until the setup is completed, CONNECTED afterwards. If you do not have a SCEPman instance yet, use the Set up SCEPman link to open the SCEPman deployment documentation.

Overview of the setup

The setup consists of three steps, summarized at the top of the section:

#
Step
Description

1

Copy this token into SCEPman

Trust this token by adding it to SCEPman's environment variables.

2

Enter your SCEPman URL

The base URL of your SCEPman instance.

3

Pregenerate a certificate

Optional: verify that SCEPman issues a certificate before you finish the setup.

1. Token

The Token field contains the API token that RADIUSaaS uses to authenticate against your SCEPman instance. The token is generated by RADIUSaaS and shown masked by default.

  • Click the eye icon to reveal the token.

  • Click the copy icon to copy it to your clipboard.

The token is read-only. It cannot be set or changed in the RADIUSaaS Admin Portal — you only enter it on the SCEPman side.

Transfer the token to SCEPman by creating the application setting AppConfig:RADIUSaaSValidation:Token in your SCEPman App Service, as described in this guide. We recommend storing the value as a secret in Azure Key Vault using the name AppConfig--RADIUSaaSValidation--Token. Apply the settings and restart your App Service afterwards.

2. SCEPman URL

Enter the base URL of your SCEPman instance, for example https://<your-scepman-instance>.azurewebsites.net. The Connect button stays disabled until a URL has been entered.

3. Pregenerate a certificate (optional)

Before finishing the setup, you can let RADIUSaaS request a test certificate from SCEPman. This confirms that the token and the URL are correct and that SCEPman is able to issue a certificate. The pregenerated certificate is added to your Server Certificates but is not activated.

Connect

Click Connect to establish the connection.

This action deactivates the currently active server certificate so that the newly issued certificate can be managed by RADIUSaaS. Ensure that your clients and RadSec-enabled authenticators trust the SCEPman Root CA before you connect, otherwise authentication will fail.

After a successful setup, the status changes to CONNECTED, and two additional actions become available:

  • Rotate Certificate: rotates and activates your server certificate.

  • Delete Connection: removes the configured connection. This also deletes the token and cannot be undone. To set up the connection again later, you must repeat the steps above.

Note: A new token will be automatically created after deleting the connection.

Last updated

Was this helpful?