Description of problem:

When multiple Issuing CAs are supported from a single SCEP Responder, the client SCEP request is required to indicate the ${CA-Identity} value within the SCEP request.  


Version-Release number of selected component (if applicable):


How reproducible:
The commands below are part of a bash script, and are reproducible every time.

Request GetCACaps:

Steps to Reproduce:
1. command line request from a bash script
2. sudo /usr/libexec/certmonger/scep-submit -u ${SCEP_RESPONDER} -i ${CA_Identifier} -v –c ${CACaps_file}
3. Note: it is assumed the -c switch identifies a file name that the CACaps file can be written to.

Actual results:
Sending:  http://onsiteipsec-test.trustwise.com/cgi-bin/pkiclient2.exe?operations=GetCACaps

Expected results:
Expected to send: GET http://onsiteipsec-test.trustwise.com/cgi-bin/pkiclient2.exe?operations=GetCACaps&message=poc.bt.com

Request GetCACert (requesting Root CA):

Steps to Reproduce:
1. command line request from a bash script
2. sudo /usr/libexec/certmonger/scep-submit -u ${SCEP_RESPONDER} -i ${RootCA_Identifier} -v –C $ ${RootCA_file}
3. Note: it is assumed the -C switch identifies a file name that the RootCA can be written to.

Actual results:
sending:  GET http://onsiteipsec-test.trustwise.com/cgi-bin/pkiclient2.exe?operation=GetCACert

Expected results:
Expected to send: GET http://onsiteipsec-test.trustwise.com/cgi-bin/pkiclient2.exe?operation=GetCACert&message=root.poc.bt.com


Additional info:
1. See SCEP RFC https://tools.ietf.org/html/draft-nourse-scep-23
2. Appendix C, C1 shows the GetCACaps format
3. 5.2.1 GetCACert indicates the message NVP may be omitted if the SCEP responder, is answering for a single Issuing CA. Commercial CAs tend to answer for multiple Issuing CAs. Hence, this optional value is required.

Regards
Nigel