Is strongswan compatible with NDES ?

[FelixG1316]

Hi everyone 👋

I use strongswan 5.9.11 on a device for SCEP. A customer want to make our SCEP solution with a Microsoft NDES server. Is it possible ?

In such a case, is there a specific configuration on the NDES side to make it work ?

I understood that NDES is like a fork of SCEP made by Microsoft when the RFC 8894 was still in draft state, but I may be wrong 😶

Thanks for you replies ! 🙏

[tobiasbrunner]

I understood that NDES is like a fork of SCEP made by Microsoft when the RFC 8894 was still in draft state

Well, it was a draft for a very long time (strongSwan's old scepclient implemented one of the drafts 18 years ago). No idea what version NDES might be implementing. So I guess you just have to try if the SCEP client in pki is compatible.

[FelixG1316]

Yes, it was what I concluded. With my team we managed to enroll a certificate with strongswan 5.9.5 and a NDES server, but, for many reasons, we had to upgrade to 5.9.11, and indeed, it is not working anymore with the pki CLI.

But now a customer wants to use our solution with its NDES server, and asks the required configuration. We want to answer that is not compatible, but to be sure, we wondered if someone managed to make the last version of strongswan working with NDES, and, in such a case, how.

[tobiasbrunner]

What exactly doesn't work? Might just be a question of algorithms or some other minor detail.

[FelixG1316]

Unfortunately we do not have more information at the moment, we asked more information to our customer, we are waiting for his answer

[swer21]

Hello I used the old scepclient on ubuntu 20.04 to get client certificates from our NDES server. Now when we update to Ubuntu 24.04 strongswan is also updated so I have to trey the new scep Funktion. But I don't have success.
On the old system I was doing this:
psec scepclient --out pkcs1=lctest24040.der --out cert=lctest24040.der --dn "C=DE, CN=lctest24040" -s dns=lctest24040.wago.local -s dns=lctest24040 -k 2048 --url "https://svndes01001.wago.local/certsrv/mscep/mscep.dll" --in cacert-enc=caCert-ra-1.der --in cacert-sig=caCert-ra-2.der -p $PASSWORD -f
With the new client im doing this.
ipsec pki --scep --url "https://svndes01001.wago.local/certsrv/mscep/mscep.dll" --password $PASSWORD --outform der
ipsec pki --gen > priKey.pem
ipsec pki --scep --url "https://svndes01001.wago.local/certsrv/mscep/mscep.dll" --password $PASSWORD --outform der --in priKey.der --dn 'C=DE, CN=lctest24040' --san dns=lctest24040.wago.local -san dns=lctest24040 --cacert-enc raCert.der --cacert-sig raCert-2.der --cacert caCert.der --cacert caCert-1.der --cipher des3 > lctest2404.der
But the result is

TPM 2.0 - could not load "libtss2-tcti-tabrmd.so.0"
plugin 'tpm': failed to load - tpm_plugin_create returned NULL
transaction ID: B0362D3B52B1345CCAE23B922909F09EE43EEFDC
encoding ID_KEY_ID as generalName not supported
encoding ID_KEY_ID as generalName not supported
using trusted certificate "C=DE, ST=NRW, L=Minden, O=WAGO GmbH, OU=IT, CN=SVNDES01001-MSCEP-RA"
using trusted intermediate ca certificate "C=DE, DC=local, DC=wago, O=WAGO Kontakttechnik GmbH, CN=WAGO Issuing CA"
using trusted ca certificate "C=DE, O=Wago Kontakttechnik GmbH, CN=Wago Root CA"
reached self-signed root ca with a path length of 1
failInfo: badRequest - transaction not permitted or supported
reply status is not 'SUCCESS'

Yes I didn't install libtss2-tcti-tabrmd0, because I do not have a TPM chip. But I don't believe that's the issue.
Im not sure if the "encoding ID_KEY_ID as generalName not supported" is a problem. When I google that nothing helpful to me comes up.
First I tryed without --cipher des3 but I got a message that aes is not supported.

[tobiasbrunner]

Great, thanks. I've pushed a patch to the 1831-scep-pw-encoding branch.

[swer21]

Hello, I'm happy to report that I successful requested a certificate from our NDES with the 1831-scep-pw-encoding branch.

transaction ID: BB11666142FBB5E35343E09CE8E765DF963A11B9
using trusted certificate "C=DE, ST=NRW, L=Minden, O=WAGO GmbH, OU=IT, CN=SVNDES01001-MSCEP-RA"
no issuer certificate found for "C=DE, ST=NRW, L=Minden, O=WAGO GmbH, OU=IT, CN=SVNDES01001-MSCEP-RA"
issuer is "C=DE, DC=local, DC=wago, O=WAGO Kontakttechnik GmbH, CN=WAGO Issuing CA"
reached end of incomplete trust chain for trusted certificate "C=DE, ST=NRW, L=Minden, O=WAGO GmbH, OU=IT, CN=SVNDES01001-MSCEP-RA"
Issued certificate "C=DE, ST=NRW, L=Minden, O=WAGO GmbH, CN=ubuntu2404stock"
serial: 51:00:03:2f:85:96:79:24:71:f7:57:e7:e6:00:03:00:03:2f:85
using certificate "C=DE, ST=NRW, L=Minden, O=WAGO GmbH, CN=ubuntu2404stock"
no issuer certificate found for "C=DE, ST=NRW, L=Minden, O=WAGO GmbH, CN=ubuntu2404stock"
issuer is "C=DE, DC=local, DC=wago, O=WAGO Kontakttechnik GmbH, CN=WAGO Issuing CA"
Issued certificate is not trusted, valid from May 02 12:15:40 2024 until May 02 12:15:40 2025 (currently valid)

I have to ask the Administrator about the Version of the NDES Server. Maybe there is a update for the server that let it work wit a UTF-8 password. But I expect that the server is up to date.

[tobiasbrunner]

Nice, thanks for testing. I'll line the fix up for the next release. The NDES server version would be interesting to know.

[swer21]

It turns out that we are still using Windows Server 2016. I did not receive a more precise version number of the NDES server. I have to ask the administrator if he can update it. I would like to know if the problem still exists on a newer server.

[tobiasbrunner]

OK, thanks for the information. I wouldn't put it past Microsoft, though, to not have changed anything about this in newer versions.