SCEP enrollment for ChromeOS is controlled using Google Admin, a Web-based interface for managing users and groups for an organization.

To configure Google Admin for SCEP enrollment

  1. Log in to Google Admin (https://admin.google.com).
  2. Navigate to Devices > Networks.
    The Networks page appears.
  3. Click on the Certificates pane.
    The Certificates page appears.
  4. Add the entire CA certificate chain (from the root CA to the issuing CA) for the Managed CA. To add a CA certificate:
    1. Click Add Certificate. The Add Certificate page appears.
    2. In the Name field, enter a unique friendly name for the CA certificate,
    3. Click Upload and then select the CA certificate you want to upload.
    4. Select Chromebook.
    5. Click Add.
  5. Navigate to Devices > Networks.
  6. The Networks page appears.
  7. Click on the Secure SCEP pane.
    The Secure SCEP page appears.
  8. Create a SCEP profile:
    1. Click ADD SECURE SCEP PROFILE. The Edit Secure SCEP page appears.
    2. For Device platforms, select the Chromebook platforms that will enroll for a certificate over SCEP:
      • Select Chromebook (user) for Chromebook users.
      • Select Chromebook (device) for Chromebook devices.
    3. For SCEP profile name, enter a unique name for the SCEP profile.

    4. For Subject name format, define the desired Subject Name format. 

      The key usages you specify in the SCEP profile must match the certificate profile used in the SCEP server URL (SCEP enrollment URL). For example, if both Key encipherment and Signing are selected, then the certificate profile used in the SCEP server URL must include both encryption and signing key usages. For example in Entrust PKI as a Service (PKIaaS) deployments, if both Key encipherment and Signing are selected, then the certificate profile used in the SCEP server URL must be scep-digital-signature-key-encipherment.
    5. For Key Usage, select each key usage that will be included in the issued certificates.
    6. For Key size (bits), select a key size for the issued certificates.
    7. For Security, select the security level (attestation requirement) for the issued certificates.
    8. In the SCEP server URL field, enter the CEG SCEP Service URL.
    9. For Certificate validity period (years), enter a lifetime (in years).
      The certificate validity period will be ignored for SCEP enrollment with Certificate Enrollment Gateway. The lifetime for issued certificates is controlled by the issuing CA. For Entrust PKI as a Service, the default certificate lifetime is 1 year.
    10. For Renew within days, enter the renewal period (in days) for certificates. The renewal period is the number of days before a certificate expires. Certificates that will expire within this period will be renewed.
    11. For Extended key usage, select the extended key usage extensions that will be included in the issued certificates.
    12. For Challenge type, select Static and then enter the challenge password defined in the CEG SCEP Service.
    13. For Certificate Authority, select the issuing CA certificate (Managed CA certificate) that you uploaded earlier.
    14. (Optional.) For Network type, select the network types that will use the SCEP profile.
    15. Click SAVE.