Hi Mark, Thank you for your quick response. I did not realise that sampleconfig automatically adds a SCEP certificate. If I had taken the time to view the script before submitting this request I would have seen the SCEP entry for scep.crt and scep.key. I plan to continue testing SCEP with the script-generated certificates, keeping everything as simple as possible.
The 'Enabling the SCEP service' section of the 'Quickstart guide' on 'https://openxpki.readthedocs.io' mentions the token import command. I failed to realise that this is already done for you if you run the sampleconfig script. Out of interest, I selected an RSA key when I manually-generated the TLS/Web Server certificate that I originally planned to use and I also selected the 'do not encrypt' option. After exporting the PKCS12 file, I uploaded it to my debian system then dumped all the information using 'openssl pkcs12 -info *.p12', entering the private key password when prompted. The private key was enclosed in : -----BEGIN ENCRYPTED PRIVATE KEY----- -----END ENCRYPTED PRIVATE KEY----- but I'm unsure how to test if it's readable or not. I intend to focus on getting SCEP working now, but can do more testing if that helps. It would be ice to know if the issue I encountered was specific to the private key, or something else. Mark On Friday 29 August 2025 at 05:30:45 BST, Oliver Welter <[email protected]> wrote: Hi Mark, first of all - sampleconfig already sets up the cli connection and also adds a SCEP certificate, does this work for you? What format is your SCEP key? Currently only RSA is supported and I had some issues in the past with encrypted key - so if you can perhaps share the command you used to generate this it might help tracking this down. You might try to import only the cert without the key (will not work afterwards but sheds some light on the root cause). Please check the logs of the server after trying the import - the "unable to decode message" sounds like something in the server throws an exception. Oliver On 28.08.25 18:00, Mark via OpenXPKI-users wrote: I have built OpenXPKI Community Edition v3.32.8 on Debian 12.11 using the demo configuration (sampleconfig.sh). It is running and issuing certificates from externally-generated CSRs. I wish to enable the SCEP Server so, following the instructions in the Quickstart guide, I have generated a 'TLS/Web Server' certificate in the 'Open Source Trustcenter', then exported the certificate and private key then placed in scep.crt and scep.key. I created a key pair for the client using the 'oxi cli create' and placed these in the '~/.oxi/client.key' and 'config.d/system/cli.yaml' files, taking care that the yaml syntax is valid. When I try and register the scep token with the 'oki token add --real democa --type scep --cert scep.crt --key scep.key' command, I am getting an 'Unable to decode' message. Can you provide some guidance on how to fix this issue ( I have attempted several times already ). _______________________________________________ OpenXPKI-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openxpki-users -- Protect your environment - close windows and adopt a penguin! _______________________________________________ OpenXPKI-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openxpki-users
_______________________________________________ OpenXPKI-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openxpki-users
