Error when trying to generate certificate

[ishackigozi]

Hello,

I am using version v2.2.0-7-g3e65c81 of scepclient and trying to follow the instructions in this link.

https://www.keytos.io/docs/azure-pki/create-ssl-certificates-with-mdm/intune-certificate-authority/create-intune-certificate-profiles/how-to-install-scep-certificate-in-linux/

I get this error below. What could be the root cause? We have mscep server in our environment.

level=info ts=2025-08-19T20:19:31.158886897Z op=GetCACaps error=null took=144.696451ms
level=info ts=2025-08-19T20:19:31.303950004Z op=PKIOperation error=null took=145.020937ms
ts=2025-08-19T20:19:31.304385049Z level=debug msg="parsed scep pkiMessage" scep_message_type="CertRep (3)" transaction_id="NiUR7NQKITZBoNDHx29qXySYplo="
PKCSReq (19) request failed, failInfo: badMessageCheck (1)

export BINARY_NAME=scepclient
curl -o $BINARY_NAME https://download.keytos.io/Downloads/linux-scripts/scepclient-linux-amd64
chmod +x $BINARY_NAME

echo "Generating Private Key"
export PRIVATE_KEY_PATH=key.pem
openssl genrsa -traditional -out $PRIVATE_KEY_PATH 2048

./$BINARY_NAME
-server-url $EZCA_STATIC_CHALLENGE_SCEP_URL
-private-key $PRIVATE_KEY_PATH
-challenge $SCEP_STATIC_CHALLENGE
-cn $USER_CERTIFICATE_COMMON_NAME
-organization $USER_CERTIFICATE_ORGANIZATION
-ou $USER_CERTIFICATE_ORGANIZATION_UNIT
-country $USER_CERTIFICATE_COUNTRY
-debug $DEBUG

HOSTNAME=hostname
EZCA_STATIC_CHALLENGE_SCEP_URL="https://xxxxxxxxxxxxxxxxxxxxxxxxxx/certsrv/mscep/"
PRIVATE_KEY_PATH=./key.pem
SCEP_STATIC_CHALLENGE="217E35D175"
USER_CERTIFICATE_COMMON_NAME=$HOSTNAME.fqdn
USER_CERTIFICATE_ORGANIZATION="OU=Computers"
USER_CERTIFICATE_COUNTRY="USA"
USER_CERTIFICATE_ORGANIZATION_UNIT="xxx"
DEBUG="enable"

Above are the Variables I am using. Please kindly advise.

[alanssitis]

Hi upstream maintainers! Just to clarify, the binary downloaded is a built version of our fork, available in https://github.com/markeytos/golang-scep.

For context, the only change on our side from upstream can be seen in the following: main...markeytos:golang-scep:main

[jessepeterson]

I think the scep server sent back that FailInfo message. Does the server have any logs about what happened?

[ishackigozi]

025-08-19 18:38:10 10.xxx.xxxx.2 GET /certsrv/mscep/ operation=GetCACert 443 - 10.xxx.xxxx.2 Go-http-client/2.0 - 200 0 0 140
2025-08-19 18:38:10 10.xxx.xxxx.2 GET /certsrv/mscep/ operation=GetCACaps 443 - 10.xxx.xxxx.25 Go-http-client/2.0 - 200 0 0 140
2025-08-19 18:38:10 10.xxx.xxxx.2 POST /certsrv/mscep/ operation=PKIOperation 443 - 10.xxx.xxxx.2 Go-http-client/2.0 - 200 0 0 156

Those are the only logs on the server end.

[FTP119]

how can i enroll with a ecdsa key instead of rsa , when i create ecdsa key and enroll for a certificate i get "unmatched type or headers"

[jessepeterson]

@FTP119 We don't support EC keys, sorry. Maybe try https://github.com/smallstep/certificates