Subject: Re: [saag] Status of the SCEP RFC draft

From: Carl Wallace <[email-masked]>
Date: Thu, 07 Dec 2017 10:12:21 -0500

Likewise. I volunteered to be the doc shepherd for this draft after
voicing objection to the historic designation earlier this year. I've
implemented a couple of SCEP implementations for mobile device purposes in
the last couple of years. Standards track seems like the correct
designation. 

On 12/7/17, 10:07 AM, "saag on behalf of Tim Hollebeek"
<[email-masked] on behalf of [email-masked]> wrote:

>I can confirm that SCEP is required for Apple MDM (I previously led a team
>that implemented SCEP as part of a mobile security product).
>
>I find the perspective that SCEP is only of historical interest to  be
>somewhat baffling.
>
>-Tim
>
>-----Original Message-----
>From: saag [mailto:[email-masked]] On Behalf Of Peter Gutmann
>Sent: Wednesday, December 6, 2017 8:49 PM
>To: [email-masked]
>Subject: [saag] Status of the SCEP RFC draft
>
>After 18 years in the draft stage, this is finally ready for publication.
>The one sticking point is its status, which I think should be Standards
>Track but others think should be Historic.
>
>The problem with Historic is two-fold, firstly RFC 2026 defines historic
>as
>"A specification that has been superseded by a more recent specification
>or
>is for any other reason considered to be obsolete is assigned to the
>"Historic"
>level", which is in both cases the exact opposite of what SCEP is, it's
>not
>superseded and it's in wider and more active use than the
>marked-as-standards- track CMP and CMC.
>
>The second is that SCEP is in extremely wide, and active use, and is
>referenced in numerous other industry standards (usually with an
>apologetic
>note about having to refer to a draft :-).  For example Apple's OTA
>profile
>configuration and delivery protocol only supports SCEP, and it seems to be
>the standard MDM mechanism in enterprise environments.  Microsoft has
>supported it as standard since Server 2003 via NDES and that's then used
>to
>provision mobile devices, as well as routers, firewalls, ... not to
>mention
>its use in SCADA, ICS, embedded, etc.  There are (at least) a billion+
>devices running SCEP today.  Like C, it'll probably be around forever
>because so much infrastructure depends on it.
>
>In addition there are new implementations as recently as the last six
>months, and more expected over time since it's pretty much the only
>protocol
>there is for automated cert provisioning of devices, or at least the only
>one that's widely deployed and that works.
>
>So both from the RFC 2026 and the pragmatic point of view, I think this
>should be published as standards-track.  It's definitely not Historic in
>either sense.
>
>Peter.
>_______________________________________________
>saag mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/saag
>_______________________________________________
>saag mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/saag