feat: replace static iOS cert embedding with SCEP for on-device key generation

iOS/macOS profiles now use a SCEP payload instead of a bundled PKCS#12.
PINT acts as a SCEP Registration Authority: it issues a one-time challenge
at profile download time, validates it when the device submits its CSR,
and proxies the signing request to FreeIPA. iOS handles automatic renewal
before the 1-year pint_wifi cert expires, so users install the profile once
and never touch it again.

- Add internal/scep: ChallengeStore (15-min one-time tokens), RA cert
  generation/parsing (self-signed RSA 2048, never expires), and SCEP HTTP
  handler (GetCACaps, GetCACert, PKIOperation with GET fallback)
- Replace PKCS#12 identity payload in mobileconfig with com.apple.security.scep
- Revert iOS cert path in main.go back to EC marshaling for RadSec/signing certs
- Add Caddy to Procfile (only starts when PINT_SERVER_URL=https://localhost:8443)
- Wire PINT_SCEP_RA_CERT_SECRET through Helm chart (helper, values, deployment, role)
- Update pint_wifi profile: 1-year validity, accept RSA and EC keys
- Update profile page: "1 year" validity, Manual Configuration section for
  Android/Windows/Linux, collapsible SCEP explainer for iOS/macOS
- Add date to dev log timestamps
- Update README: dual cert-gen paths with sequence diagrams, SCEP RA notes,
  Testing SCEP Locally section

Author: mbillow

Procfile

@@ -1,2 +1,3 @@
 pint: set -a && . .env.dev && set +a && until nc -z localhost 8088; do sleep 0.2; done && ./pint
 ipa-stub: set -a && . .env.dev && set +a && ./freeipa-stub
+caddy: set -a && . .env.dev && set +a && if [ "$PINT_SERVER_URL" = "https://localhost:8443" ]; then caddy reverse-proxy --from https://localhost:8443 --to http://localhost:8080; else sleep infinity; fi

README.md

@@ -23,36 +23,65 @@ flowchart TD
 
 ### Certificate Generation via FreeIPA
 
-Every certificate PINT issues follows the same path: generate a secp384r1 ECDSA keypair locally, build a CSR, and call FreeIPA's `cert_request` RPC with the appropriate CA and profile. FreeIPA's Dogtag CA signs the cert and returns the DER-encoded result. The private key never leaves PINT; it is either bundled into the download or shown once and discarded.
+PINT uses two distinct paths to issue WiFi client certificates depending on the platform.
+
+**iOS and macOS — SCEP (on-device key generation)**
+
+PINT acts as a SCEP Registration Authority. The device generates its own RSA 2048 keypair locally and enrolls through the `/scep` endpoint embedded in the mobileconfig. The private key never leaves the device, and iOS handles automatic renewal before the certificate expires.
+
+```mermaid
+sequenceDiagram
+    participant iOS as iOS / macOS Device
+    participant P as PINT
+    participant IPA as FreeIPA (Dogtag)
+
+    iOS->>P: Download profile (authenticated)
+    P->>P: Issue one-time SCEP challenge
+    P-->>iOS: Mobileconfig with SCEP payload + challenge
+    note over iOS: Profile installed; device generates RSA 2048 keypair
+    iOS->>P: SCEP PKIOperation (CSR + challenge, CMS-wrapped)
+    P->>P: Validate challenge; extract username
+    P->>IPA: cert_request(CSR, username, pint_wifi)
+    IPA-->>P: Signed certificate (DER)
+    P-->>iOS: CMS-wrapped certificate response
+    note over iOS: Certificate installed; WiFi connects automatically
+    note over iOS,P: Near expiry: iOS re-runs SCEP automatically
+```
+
+The SCEP Registration Authority (RA) uses a self-signed RSA 2048 certificate (CN `CSH PINT SCEP RA`) stored in the `pint-scep-ra-cert` Kubernetes Secret. PINT generates this automatically on first startup if the Secret does not exist. It is intentionally self-signed and set to never expire. The RA cert is not a trust anchor; it is only used to encrypt the CMS envelope during the SCEP exchange. iOS identifies it via the SHA-1 fingerprint embedded in the mobileconfig's SCEP payload.
+
+**All other platforms — server-side key generation**
+
+For Android, Windows, and Linux, PINT generates a secp384r1 ECDSA keypair, submits the CSR to FreeIPA's `cert_request` RPC, and bundles the result into a PKCS#12 archive for download. The private key is shown once and never stored.
 
 ```mermaid
 sequenceDiagram
-    participant Client as Browser / CLI
+    participant Client as Browser
     participant P as PINT
     participant IPA as FreeIPA (Dogtag)
 
-    Client->>P: Request enrollment
+    Client->>P: Request profile download
     P->>P: Generate secp384r1 keypair + CSR
     P->>IPA: cert_request(CSR, principal, CA, profile)
     IPA-->>P: Signed certificate (DER)
-    P->>P: Bundle into profile / p12 / PEM
+    P->>P: Bundle into .p12 / .xml
     P-->>Client: Download
 ```
 
 PINT authenticates to FreeIPA using a service account specified by `PINT_IPA_SERVICE_ACCOUNT` and `PINT_IPA_PASSWORD`. The session is established at startup and re-authenticated automatically on 401.
 
 #### Profiles
 
-Three custom Dogtag certificate profiles control validity, key usage, and subject enforcement. All profiles force `O=CSH.RIT.EDU` in the issued certificate subject regardless of what the CSR contains, and all require secp384r1 EC keys.
+Three custom Dogtag certificate profiles control validity, key usage, and subject enforcement. All profiles force `O=CSH.RIT.EDU` in the issued certificate subject regardless of what the CSR contains.
 
-| Profile | Purpose | Validity | EKU |
-|---|---|---|---|
-| `pint_wifi` | EAP-TLS client certs for member devices | 5 years | `clientAuth` |
-| `pint_radsec_client` | mTLS client certs for WiFi controllers | 5 years | `clientAuth` |
-| `pint_radsec_server` | mTLS server cert for the FreeRADIUS RadSec listener | 90 days | `serverAuth` |
-| `pint_profile_signing` | CMS signing cert for iOS mobileconfig profiles | 1 year | `codeSigning` |
+| Profile | Purpose | Validity | Key | EKU |
+|---|---|---|---|---|
+| `pint_wifi` | EAP-TLS client certs for member devices | 1 year | RSA 2048 or EC | `clientAuth` |
+| `pint_radsec_client` | mTLS client certs for WiFi controllers | 5 years | EC (secp384r1) | `clientAuth` |
+| `pint_radsec_server` | mTLS server cert for the FreeRADIUS RadSec listener | 90 days | EC (secp384r1) | `serverAuth` |
+| `pint_profile_signing` | CMS signing cert for iOS mobileconfig profiles | 1 year | EC (secp384r1) | `codeSigning` |
 
-Five-year validity on client certs minimises re-enrollment burden. The 90-day server cert and 1-year profile signing cert are automatically renewed by PINT (see [RadSec Server Cert](#radsec-server-cert) and [Profile Signing Cert](#profile-signing-cert)).
+The `pint_wifi` profile accepts both RSA and EC keys because iOS generates RSA 2048 on-device via SCEP while other platforms submit EC keypairs generated by PINT. The 1-year validity is short enough to rotate credentials regularly while remaining transparent to users on iOS/macOS, where SCEP handles renewal automatically. The 90-day server cert and 1-year profile signing cert are also automatically renewed by PINT (see [RadSec Server Cert](#radsec-server-cert) and [Profile Signing Cert](#profile-signing-cert)).
 
 Profile config files live in `ipa/profiles/`. They must be imported into FreeIPA once before PINT can use them. Use `ipa/update_profile.py`, which supports three actions:
 
@@ -82,11 +111,11 @@ Members visit `/profile` and download a platform-specific package. PINT issues a
 
 | Platform | Output | Contents |
 |---|---|---|
-| iOS / macOS | `.mobileconfig` (Apple Configuration Profile) | PKCS#12 identity, WiFi CA, root CA, 802.1X/EAP-TLS config; optionally CMS-signed |
+| iOS / macOS | `.mobileconfig` (Apple Configuration Profile) | SCEP payload, WiFi CA, root CA, code-signing CA, 802.1X/EAP-TLS config; optionally CMS-signed |
 | Android | `.p12` (PKCS#12) | Client cert + key + WiFi CA, imported via Android WiFi settings |
 | Windows | `.xml` (WLAN profile) + `.p12` (PKCS#12) | EAP-TLS config and CA thumbprint; cert imported separately into the Windows certificate store |
 
-The iOS mobileconfig always embeds the WiFi intermediate CA and root CA so the full trust chain is installed in one step. When `PINT_IPA_CODE_SIGNING_CA_NAME` is set, PINT also embeds the code-signing intermediate CA and wraps the profile in a CMS `SignedData` envelope, letting iOS display it as "Verified" after the CA profile is trusted.
+The iOS mobileconfig always embeds the WiFi intermediate CA and root CA so the full trust chain is installed in one step. The SCEP payload instructs iOS to generate a keypair on-device, enroll with PINT's `/scep` endpoint using a one-time challenge, and renew automatically near expiry — users never need to re-download the profile. When `PINT_IPA_CODE_SIGNING_CA_NAME` is set, PINT also embeds the code-signing intermediate CA and wraps the profile in a CMS `SignedData` envelope, letting iOS display it as "Verified" after the CA profile is trusted.
 
 ### WiFi Controller Enrollment
 
@@ -315,6 +344,7 @@ Set `envSecret` in your values to the name of this Secret. The chart mounts it v
 | `helm` | Deploy the chart into kind |
 | `kubectl` | Interact with the dev cluster |
 | `overmind` | Run the Procfile (PINT + FreeIPA stub simultaneously) |
+| `caddy` | HTTPS reverse proxy for local SCEP testing (iOS requires TLS) |
 
 ### Local Setup
 
@@ -332,10 +362,11 @@ cp .env.dev.example .env.dev
 make dev
 ```
 
-`make dev` starts two processes via `overmind` and the `Procfile`:
+`make dev` starts three processes via `overmind` and the `Procfile`:
 
 - **`ipa-stub`**: FreeIPA stub server on `:8088` (see [FreeIPA Stub](#freeipa-stub) below).
 - **`pint`**: the PINT server on `:8080`. It waits for the stub to be ready before starting.
+- **`caddy`**: HTTPS reverse proxy from `https://localhost:8443` to `http://localhost:8080`. Only starts when `PINT_SERVER_URL=https://localhost:8443` (see [Testing SCEP Locally](#testing-scep-locally) below); otherwise it idles.
 
 FreeRADIUS runs in the kind cluster and persists between `make dev` sessions. PINT talks to it via the Kubernetes API using your local `~/.kube/config`.
 
@@ -392,10 +423,31 @@ All configuration is via environment variables. Copy `.env.dev.example` to `.env
 | `PINT_RADIUS_STATUS_PORT` | `18121` | FreeRADIUS status server port |
 | `PINT_RADIUS_RADSEC_CHECK_CRL` | `true` | Enable CRL checking in the RadSec TLS listener |
 | `PINT_RADIUS_RADSEC_PROXY_PROTOCOL` | `false` | Expect HAProxy PROXY protocol header on RadSec connections; set `true` when HAProxy fronts FreeRADIUS |
+| `PINT_SCEP_RA_CERT_SECRET` | `pint-scep-ra-cert` | K8s Secret for the SCEP Registration Authority (RA) certificate and key; auto-generated on first startup |
 | `PINT_IPA_SKIP_TLS_VERIFY` | `false` | Skip FreeIPA TLS verification (dev only) |
 | `PINT_DISABLE_OIDC` | `false` | Bypass OIDC and inject a static dev user |
 | `PINT_DEV_RTP` | `false` | Inject `rtp` group into dev user (requires `PINT_DISABLE_OIDC=true`) |
 
+### Testing SCEP Locally
+
+iOS requires HTTPS to complete SCEP enrollment, so local testing needs a TLS frontend. Caddy handles this automatically when you set `PINT_SERVER_URL` to the local HTTPS address in `.env.dev`:
+
+```bash
+# .env.dev
+PINT_SERVER_URL=https://localhost:8443
+PINT_DISABLE_OIDC=true   # skip OIDC so you can download profiles without a Keycloak session
+```
+
+With those two variables set, `make dev` will start Caddy alongside PINT. On first run, Caddy generates a local CA and certificate. Trust it system-wide so the iOS profile installer accepts the mobileconfig:
+
+```bash
+sudo security add-trusted-cert -d -r trustRoot \
+  -k /Library/Keychains/System.keychain \
+  "$HOME/Library/Application Support/Caddy/pki/authorities/local/root.crt"
+```
+
+After that, download a profile from `https://localhost:8443/profile`, install it on a device on the same network, and watch PINT's logs for the SCEP `PKIOperation` request and the resulting cert issuance. The SCEP Registration Authority (RA) certificate is auto-generated and stored in the `pint-scep-ra-cert` Kubernetes Secret on first startup; it persists across restarts.
+
 ### FreeIPA Stub
 
 The stub (`dev/freeipa-stub/`) is a minimal HTTPS server that implements just enough of the FreeIPA JSON-RPC API for PINT to function locally. It runs on `:8088` with a self-signed TLS certificate, so `PINT_IPA_SKIP_TLS_VERIFY=true` must be set in `.env.dev`.
@@ -433,7 +485,8 @@ The stub maps profile IDs to EKU and validity:
 |---|---|---|---|
 | `pint_radsec_server` | `serverAuth` | 90 days | DNS SAN set to CSR CN (required for Go TLS verification) |
 | `pint_profile_signing` | `codeSigning` | 1 year | Only available when `PINT_IPA_CODE_SIGNING_CA_NAME` is set |
-| all others (`pint_wifi`, `pint_radsec_client`, …) | `clientAuth` | 5 years | |
+| `pint_wifi` | `clientAuth` | 1 year | Accepts RSA and EC public keys |
+| `pint_radsec_client` and others | `clientAuth` | 5 years | |
 
 Unlike real FreeIPA/Dogtag, the stub does not enforce subject name patterns or key type constraints defined in the profile config files.
 

chart/templates/_helpers.tpl

@@ -58,6 +58,10 @@ never collide. Each can be overridden via the corresponding values key.
 {{- .Values.secrets.profileSigningCert | default (printf "%s-profile-signing-cert" (include "pint.fullname" .)) }}
 {{- end }}
 
+{{- define "pint.secretName.scepRACert" -}}
+{{- .Values.secrets.scepRACert | default (printf "%s-scep-ra-cert" (include "pint.fullname" .)) }}
+{{- end }}
+
 {{- define "pint.envSecret" -}}
 {{- .Values.envSecret | default (include "pint.fullname" .) }}
 {{- end }}

chart/templates/deployment.yaml

@@ -96,6 +96,8 @@ spec:
               value: {{ include "pint.secretName.config" . | quote }}
             - name: PINT_RADSEC_CERT_SECRET
               value: {{ include "pint.secretName.radSecCert" . | quote }}
+            - name: PINT_SCEP_RA_CERT_SECRET
+              value: {{ include "pint.secretName.scepRACert" . | quote }}
             {{- if .Values.freeradius.enabled }}
             - name: PINT_FREERADIUS_DEPLOYMENT
               value: {{ include "pint.freeradiusFullname" . | quote }}

chart/templates/role.yaml

@@ -14,6 +14,7 @@ rules:
     resourceNames:
       - {{ include "pint.secretName.config" . | quote }}
       - {{ include "pint.secretName.radSecCert" . | quote }}
+      - {{ include "pint.secretName.scepRACert" . | quote }}
       {{- if .Values.config.codeSigningCAName }}
       - {{ include "pint.secretName.profileSigningCert" . | quote }}
       {{- end }}

chart/values.yaml

@@ -65,6 +65,7 @@ secrets:
   config:              ""  # default: <fullname>-config  (clients.json, clients.conf, status-secret, status)
   radSecCert:          ""  # default: <fullname>-radsec-server-certificates  (tls.crt, tls.key, ca.pem, wifi-ca.pem)
   profileSigningCert:  ""  # default: <fullname>-profile-signing-cert  (tls.crt, tls.key); only created when codeSigningCAName is set
+  scepRACert:          ""  # default: <fullname>-scep-ra-cert  (tls.crt, tls.key); auto-generated on first startup
 
 service:
   type: ClusterIP

cmd/pint/main.go

@@ -3,6 +3,7 @@ package main
 
 import (
 	"context"
+	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
@@ -18,6 +19,7 @@ import (
 	"github.com/ComputerScienceHouse/pint/internal/logger"
 	"github.com/ComputerScienceHouse/pint/internal/profile"
 	"github.com/ComputerScienceHouse/pint/internal/radius"
+	internscep "github.com/ComputerScienceHouse/pint/internal/scep"
 	"github.com/gin-contrib/multitemplate"
 	"github.com/gin-gonic/gin"
 	"go.uber.org/zap"
@@ -164,6 +166,15 @@ func main() {
 	// Background watcher: renew cert before expiry and reload FreeRADIUS
 	go watchRadSecServerCert(log, k8sClient, ipaClient, cfg, []byte(radSecCAChainPEM), wifiCAPEM)
 
+	// Load or generate the SCEP RA cert (self-signed RSA, stored in K8s secret).
+	scepRACert, scepRAKey, scepRACertDER, err := loadOrGenerateSCEPRACert(context.Background(), log, k8sClient, cfg)
+	if err != nil {
+		log.Fatal("scep RA cert init failed", zap.Error(err))
+	}
+	log.Info("scep RA cert loaded", zap.String("subject", scepRACert.Subject.CommonName), zap.String("expires", scepRACert.NotAfter.Format("2006-01-02")))
+
+	challengeStore := internscep.NewChallengeStore()
+
 	// Load or request the profile signing cert when code signing is configured.
 	var appleSigner *profile.Signer
 	if cfg.CodeSigningCAName != "" {
@@ -214,6 +225,13 @@ func main() {
 		r.GET("/auth/logout", auth.HandleLogout)
 	}
 
+	// SCEP public routes — iOS calls these without a session cookie.
+	scepHandler, err := internscep.NewHandler(log, challengeStore, ipaClient, cfg.IPAWirelessCAName, cfg.IPACertProfile, scepRACert, scepRAKey, caDER, rootCACertDER)
+	if err != nil {
+		log.Fatal("scep handler init failed", zap.Error(err))
+	}
+	scepHandler.Register(r)
+
 	// Public routes
 	r.GET("/", handlers.IndexHandler(cfg.LoginURL))
 
@@ -225,7 +243,7 @@ func main() {
 	{
 		protected.GET("/dashboard", handlers.DashboardHandler())
 		protected.GET("/profile", handlers.ProfilePageHandler(cfg))
-		protected.POST("/profile/generate", handlers.GenerateProfileHandler(log, ipaClient, cfg, caDER, rootCACertDER, codeSigningCACertDER, appleSigner))
+		protected.POST("/profile/generate", handlers.GenerateProfileHandler(log, ipaClient, cfg, caDER, rootCACertDER, codeSigningCACertDER, scepRACertDER, challengeStore, appleSigner))
 		protected.GET("/profile/ca", handlers.CAHandler(caDER))
 		protected.GET("/radius", handlers.RadiusPageHandler(cfg, k8sClient, radSecCAChainPEM))
 		protected.POST("/radius/secret", handlers.SaveSecretHandler(log, ipaClient, cfg, k8sClient, radSecCAChainPEM))
@@ -386,7 +404,7 @@ func loadOrRenewProfileSigningCert(ctx context.Context, log *zap.Logger, k8sClie
 	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
 	ecKeyBytes, err := x509.MarshalECPrivateKey(privKey)
 	if err != nil {
-		return nil, false, fmt.Errorf("marshal profile signing key: %w", err)
+		return nil, false, fmt.Errorf("marshal profile signing ec key: %w", err)
 	}
 	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: ecKeyBytes})
 
@@ -428,6 +446,40 @@ func profileSignerFromPEM(cert *x509.Certificate, keyPEM, codeSigningCACertDER [
 	return s, nil
 }
 
+// loadOrGenerateSCEPRACert loads the self-signed SCEP RA cert from the K8s Secret,
+// generating a new one if absent. Returns the parsed cert, key, and raw DER bytes.
+func loadOrGenerateSCEPRACert(ctx context.Context, log *zap.Logger, k8sClient kubernetes.Interface, cfg *config.Config) (*x509.Certificate, *rsa.PrivateKey, []byte, error) {
+	secret, err := k8sClient.CoreV1().Secrets(cfg.Namespace).Get(ctx, cfg.SCEPRACertSecret, metav1.GetOptions{})
+	if err == nil {
+		certPEM := secret.Data["tls.crt"]
+		keyPEM := secret.Data["tls.key"]
+		if len(certPEM) > 0 && len(keyPEM) > 0 {
+			cert, key, parseErr := internscep.ParseRACert(certPEM, keyPEM)
+			if parseErr == nil {
+				log.Info("reusing existing SCEP RA cert", zap.String("expires", cert.NotAfter.Format("2006-01-02")))
+				return cert, key, cert.Raw, nil
+			}
+		}
+	}
+
+	cert, key, certPEM, keyPEM, genErr := internscep.GenerateRACert()
+	if genErr != nil {
+		return nil, nil, nil, fmt.Errorf("generate SCEP RA cert: %w", genErr)
+	}
+
+	raSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: cfg.SCEPRACertSecret, Namespace: cfg.Namespace},
+		Data:       map[string][]byte{"tls.crt": certPEM, "tls.key": keyPEM},
+	}
+	if _, createErr := k8sClient.CoreV1().Secrets(cfg.Namespace).Create(ctx, raSecret, metav1.CreateOptions{}); createErr != nil {
+		if _, updateErr := k8sClient.CoreV1().Secrets(cfg.Namespace).Update(ctx, raSecret, metav1.UpdateOptions{}); updateErr != nil {
+			return nil, nil, nil, fmt.Errorf("store SCEP RA cert: %w", updateErr)
+		}
+	}
+	log.Info("generated new SCEP RA cert")
+	return cert, key, cert.Raw, nil
+}
+
 // watchProfileSigningCert runs forever, checking daily whether the profile signing cert
 // needs renewal. Renewed certs are stored in K8s; pint picks them up on next restart.
 func watchProfileSigningCert(log *zap.Logger, k8sClient kubernetes.Interface, ipaClient *freeipa.Client, cfg *config.Config, codeSigningCACertDER []byte) {

go.mod

@@ -7,11 +7,12 @@ require (
 	github.com/gin-contrib/multitemplate v1.1.2
 	github.com/gin-gonic/gin v1.12.0
 	github.com/google/uuid v1.6.0
+	github.com/smallstep/scep v0.0.0-20260331191114-261f960a40d1
+	go.uber.org/zap v1.28.0
 	howett.net/plist v1.0.1
 	k8s.io/api v0.36.0
 	k8s.io/apimachinery v0.36.0
 	k8s.io/client-go v0.36.0
-	go.uber.org/zap v1.28.0
 	software.sslmate.com/src/go-pkcs12 v0.7.1
 )
 
@@ -53,6 +54,7 @@ require (
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/quic-go/quic-go v0.59.0 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/smallstep/pkcs7 v0.2.1 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.1 // indirect