# Used in some dropdowns on the UI as name for this endpoint
label: Generic SCEP

# A renewal request is only accpeted if the used certificate will
# expire within this period of time.
renewal_period: 000060

# Create certificates for initial requests with a short validity to
# allow an immediate renewal
# initial_validity: +000030

# If the request was a replacement, optionally revoke the replaced
# certificate after a grace period
revoke_on_replace:
    reason_code: keyCompromise
    delay_revocation_time: +000014

# if you remove this section, any non-renewal request will be treated
# as an initial request, this works around non-standard MDM and devices
# authorized_signer:
#     rule1:
#         # Full DN
#         subject: CN=.+:pkiclient,.*
#     rule2:
#         # Full DN
#             subject: CN=my.scep.enroller.com:generic,.*

policy:
    # Authentication Options
    # Initial requests need ONE authentication.
    # Activate Challenge Password and/or HMAC by setting the appropriate
    # options below.

    # if set requests can be authenticated by an operator
    allow_man_authen: 1

    # if set, no authentication is required at all and hmac/challenge is
    # not evaluated even if it is set/present in the request!
    allow_anon_enroll: 1

    # Approval
    # If not autoapproved, allow opeerator to add approval by hand
    allow_man_approv: 1

    # if the eligibiliyt check failed the first time
    # show a button to run a recheck (Workflow goes to PENDING)
    allow_eligibility_recheck: 0

    # Approval points are used to set a threshold for the system to grant
    # approval, and they help measure a request to see whether the
    # requirement is fulfilled. If you set this to "0", no points are
    # required and all authenticated requests are auto-approved.
    # If the eligibilty check returned success and no approval rules are
    # defined, you get one point for the passed check. If approval rules
    # are given, the eligibility check is a prereq for their evaluation
    # and there is NO point for the eligibility check itself!
    # If you dont reach the required number of points after this step and
    # allow_man_approv is set you can fill up the missing points by a
    # manual operator approval (one point per operator)
    approval_points: 0

    # The number of active certs with the same subject that are allowed
    # to exist at the same time. The predecessor is NOT included in this
    # count so a renewal inside the expected interval is always allowed!
    # set to 0 if you dont want to check for duplicates at all
    max_active_certs: 0

    # If the number of certificates found exceed max_active_certs and this
    # flag is set, ALL duplicates (except the predecessor) will be revoked
    # after the new certificate was issued
    # This flag is ineffective on self-signed renewals!
    auto_revoke_existing_certs: 1

    # allows a "renewal" outside the renewal window, the notafter date
    # is aligned to the old certificate. Set revoke_on_replace option
    # to revoke the replaced certificate.
    # This substitutes the "replace_window" from the OpenXPKI v1 config
    allow_replace: 0

profile:
  cert_profile: tls_server
  cert_subject_style: enroll

# Mapping of names to OpenXPKI profiles to be used with the
# Microsoft Certificate Template Name Ext. (1.3.6.1.4.1.311.20.2)
profile_map:
    pc-client: tls_client
    tls-server: tls_server
    tls-client: tls_client

# HMAC based authentication
hmac: verysecret

challenge:
    value: SecretChallenge

eligible:
    initial:
       value@: connector:scep.generic.connector.initial
       args: '[% context.cert_subject_parts.CN.0 %]'
       expect:
         - Build
         - New

    renewal:
       value: 1

    onbehalf:
       value: 1


connector:
    initial:
        class: Connector::Proxy::YAML
        # this file must have a key/value list with the key being
        # the subject and the value being a true value
        # e.g. "pc1234.example.org: 1"
        LOCATION: /home/pkiadm/cmdb.yaml
