Renew NDES SCEP certificates

[noahtalerman]

UPDATE: @noahtalerman: Closed this request. Let's use this request instead:

• Help end users connect to Wi-Fi with certificates from certificate authority (NDES, DigiCert, etc.) #13420

---

Gong snippet: prospect-hubble: https://us-65885.app.gong.io/call?id=4210985230183928646&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A902%2C%22to%22%3A929%7D%5D. note that prospect-hubble uses SCEP certs, but the provider is Sectigo. Not sure if it would matter in the renewal case which certificate provider has issued the cert or if the work done to date limits us to just NDES or if it was designed to be a broad solution for all PKI providers of the SCEP protocol.

---

User stories

• Renew NDES SCEP certificates #24468

[getvictor]

With the macOS profiles command (docs), we can't link the SCEP profile with a certificate, except by common name.

[getvictor]

A simple approach is to ask the user how long the certificate is issued for. We know when it is issued, so we can schedule renewal appropriately. Eventually, we would support this simple approach AND a more complex approach where we put an identifier into the common name.

I suggest we make the number of days before renewal configurable. If we are able to say that we can renew certificates every day, or even every hour, we would appeal to more security-conscious buyers, and it would make a great marketing point. cc: @spokanemac

[noahtalerman]

Follow up to add certificate renewal for the following story:

• Deploy SCEP certificates from Network Device Enrollment Service (NDES) #21955

Make this 180 days by default. Doesn't need to be configurable for now.

[noahtalerman]

This request isn't relevant to reedtimmer b/c they don't use NDES. They use SmallStep. I removed reedtimmer and moved the Gong snippet to this request instead: #8269

FYI @Patagonia121

[noahtalerman]

Closed this request. Let's use this request instead:

• Help end users connect to Wi-Fi with certificates from certificate authority (NDES, DigiCert, etc.) #13420

[fleet-release]

Certificate renewed,
SCEP protocol improved,
Trust in Fleet renewed.