Configuring SCEP endpoint for multiple realms

The default realm SCEP endpoint is http://<ipaddress>/scep/scep. If you have multiple realms, then configure a unique SCEP endpoint (different configuration file) for each realm. In the following instructions, we use two PKI realms, ca-one and ca-two.

  1. Copy the default configuration file in cp /etc/openxpki/scep/default.conf /etc/openxpki/scep/ca-one.conf.
    Note: Name the file as ca-one.conf.
  2. In nano /etc/openxpki/scep/ca-one.conf, change the realm value to realm=ca-one.
  3. Create another configuration file in cp /etc/openxpki/scep/default.conf /etc/openxpki/scep/ca-two.conf.
    Note: Name the file as ca-two.conf.
  4. In nano /etc/openxpki/scep/ca-two.conf, change the realm value to realm=ca-two.
  5. Restart the OpenXPKI service using openxpkictl restart.

The SCEP endpoints are the following:

  • ca‑one—http://ipaddress/scep/ca-one

  • ca-two—http://ipaddress/scep/ca-two

If you want to differentiate between login credentials and default certificate templates for different PKI realms, then you may need advanced configuration.