The following requirements must be met prior to proceeding with the protocol configuration.
- Compatibility with the MS server running the protocol:
- NDES is only available in the Enterprise version of Microsoft Server 2008, 2008 R2, and 2012, Standard or Enterprise.
- SCEP or MSCEP is available in versions older than Microsoft Server 2008.
- A Certificate Authority (CA) installed, configured, and made available to the NDES/SCEP/MSCEP server.
- The CA and NDES/SCEP/MSCEP can be installed on the same server or on different servers. If NDES/SCEP/MSCEP is to be installed on the same server as the CA, the installation of the CA must be completed first and the server rebooted prior to installing NDES/SCEP/MSCEP.
- The following certificate templates are needed during NDES/SCEP/MSCEP setup and service certificate renewal:
- Exchange Enrollment Agent (Offline request)
Note: It is possible for all of the following accounts to be the same account. However, there are security concerns if a single account is used.
- SCEP endpoint must be accessible from the device in order for certificate enrollment to complete.
- The exception to this requirement is when you utilize the Enable Proxy option in the Certificate Authority - Add/Edit page for non-generic SCEP protocol usage.
- An Admin Account must exist in the domain. This account is used to install the NDES/SCEP/MSCEP role service and must meet the following requirements.
- Member of the Local Administrators group (Standalone Installation)
- Member of the Domain Admins group (Enterprise)
- ‘Enroll’ permissions on NDES/SCEP/MSCEP service certificate templates (Enterprise). See Step 1: Install the Microsoft CA Role below for information on setting permissions.
- A Service Account must exist. It is used by the NDES/SCEP/MSCEP application pool and must meet the following requirements.
- Member of the local IIS_USRS group. Role installation will fail if this is not present.
- ‘Request’ permission on the configured CA. See Step 2: Set Permissions for the NDES/SCEP/MSCEP Admin Account below for information on setting permissions.
- ‘Read’ and ‘Enroll’ permissions on configured device certificate templates. See Step 2: Set Permissions for the NDES/SCEP/MSCEP Admin Account below for information on setting permissions.
- A Service Principal Name (SPN) must be added by using: SetSpn –a HTTP/<ComputerName><AccountName>
- <ComputerName> is the name of the computer where NDES/SCEP/MSCEP is installed.
- <AccountName> is the computer account name when NetworkService is used, or the domain user account when a custom application pool identity is configured.
- The Device Administrator account used to request password challenges from NDES/SCEP/MSCEP must meet the following requirements.
- ‘Enroll’ permissions on all configured device certificate templates (Enterprise). See Step 2: Set Permissions for the NDES/SCEP/MSCEP Admin Account below for information on setting permissions.
- Member of the Local Administrator group (standalone).