See below for the known issues in the Certificate Enrollment Gateway for Cryptographic Security Platform 1.5.0.

Unsupported ACMEv2 features (PKI-30901)

The Certificate Enrollment Gateway implementation of the ACME Server does not support the following RFC 8555 features:

• EdDSA signature algorithm
• Rate limits
• termsOfService optional string
• Changes of Terms of Service
• External Account Binding
• Pre-authorization

Unsupported Intune-SCEP operations (PKI-28149, PKI-31351)

The Certificate Enrollment Gateway integration with the Intune-SCEP protocol does not support the following draft-nourse-scep-23 operations:

• GetCRL
• GetNextCACert

'Enable TLS' shows OFF by default (CEG-3679)

When configuring the Certificate Enrollment Gateway in the Management Console, the Enable TLS option under Advanced Connection Settings (optional) appears as OFF by default, even though TLS is enabled by default.

Certificate Enrollment Gateway deployment fails after upgrade (CEG-3748)

When upgrading Cryptographic Security Platform from 1.4.x to 1.5.0, the Certificate Enrollment Gateway (CEG) solution can fail to deploy even though the platform upgrade completes successfully. This can also occur when you upload and deploy a CEG solution file that uses the updated configuration.

The failure occurs because the CA Gateway keystore and TLS validation certificate settings in existing Certificate Enrollment Gateway configurations are not compatible with the new connection-settings configuration section. Configure these settings under the Advanced Connection Settings section.

Workaround:

1. Log in to the Management Console.
2. Edit the Certificate Enrollment Gateway configuration.
3. In the General tab, re-upload the following files under Advanced Connection Settings:
   • CAGW Keystore File
   • CA Certificates File
4. Submit the configuration and redeploy the Certificate Enrollment Gateway solution.