An engineer needs to provision certificates on a Cisco Catalyst 9800 Series Wireless Controller. The customer uses a third-party CA server. Which protocol must be used between the controller and CA server to request and install certificates?

Simple Certificate Enrollment Protocol (SCEP) is specifically designed to automate and simplify the process of certificate enrollment for network devices. When a Cisco Catalyst 9800 WLC needs to obtain a certificate from a third-party Certificate Authority (CA), SCEP provides the standardized communication mechanism. The controller uses SCEP to generate a certificate signing request (CSR), send it to the CA, and retrieve the signed certificate for installation. This protocol is the industry standard for scalable certificate provisioning on network infrastructure devices.

B. TLS: Transport Layer Security (TLS) is a protocol that uses certificates to secure communications but is not the protocol used to request or enroll for a certificate from a CA.
C. LDAP: Lightweight Directory Access Protocol (LDAP) is used to query and manage directory services. While a directory might store certificates, LDAP is not the protocol for certificate enrollment with a CA.
D. SSL: Secure Sockets Layer (SSL) is the predecessor to TLS. Like TLS, it is used for securing data in transit and is not an enrollment protocol.

1. Cisco Systems

"Security Configuration Guide

Cisco IOS XE Bengaluru 17.6.x (Catalyst 9800 Series Wireless Controllers)". In the "Configuring SCEP for PKI" chapter

it states

"Simple Certificate Enrollment Protocol (SCEP) is a protocol that allows devices to easily enroll for a certificate by using a URL and a shared secret to communicate with a Certificate Authority (CA)." This document details the exact procedure for using SCEP on a Catalyst 9800 controller.

2. Cisco Systems

"Catalyst 9800-CL Wireless Controller for Cloud Deployment Guide". The section "Configure Trustpoints and SCEP" outlines the steps for certificate provisioning

stating: "To obtain a certificate for the trustpoint

you must configure the enrollment parameters... For SCEP enrollment

you must configure the enrollment url..." This confirms SCEP as the enrollment method.

3. N. Nourse

et al.

"RFC 8894: Simple Certificate Enrollment Protocol" (September 2020)

Internet Engineering Task Force (IETF). Section 1

Introduction

defines SCEP as "a protocol for certificate enrollment... SCEP is the evolution of the enrollment protocol developed by VeriSign

Inc.

for Cisco Systems

Inc." This foundational document establishes SCEP's purpose as certificate enrollment. (DOI: 10.17487/RFC8894)