This article provide details on interaction between CSO and PKI SCEP server / CA server based on CSO UI actions.

A. Onboard Tenant workflow

1. User fills in CA server URL and a password in CSO UI for the tenant being onboarded
2. CSO uses the GETCA request to fetch CA cert chain from the CA server url (without password) and saves the returned CA/RA/CE certs in CSO database.

B: Onboard Site workflow

1. CSO uses ENROLLMENT request to enroll local cert for site using the password from Step A.1, RA/CE certs from Step A.2. The CA server will return a local cert
2. CSO pushes the local cert(Step B.1) and CA certs(Step A.2) to the device
3. CSO saves the local cert expiration time to CSO database. Please note that only expiration time, not the entire local cert is saved in the database for security reason.

C: Auto Renewal Process in CSO 6.2 (doesn’t check for CA updates)

1. CSO checks local cert expiration time by comparing expiration time stored in Step B.3 with the current time. If the cert is about to expire, CSO sends renew request as follows.
   1. CSO uses ENROLLMENT request to enroll local cert from CA server, with saved local cert info from database (Step B.3) without password. Note: Since we do not store local cert in CSO, the request fails and moves to step C.1.b
   2. If failed, CSO uses ENROLLMENT request to enroll local cert from CA server again, with Certificate Signing Request (CSR) that includes the password.
2. CSO then pushes new local cert from the above step to the device.

D: Auto Renewal Process in CSO 6.3 (checks for CA updates )

1. If Auto Renew is enabled from CSO UI, everyday, CSO checks whether the CA/RA/CE cert has changed or not as follows:
   1. CSO uses the GETCA request to fetch the CA cert chain from CA server without password and compares it with the stored CA/RA/CE cert in CSO database.
   2. If changed, CSO will update CSO database with new CA/RA/CE cert.
2. NOTE: The above steps are the same as in A2, so nothing has changed here. It never needed password in A2 as well.
3. CSO will check local cert expiration time AND check if CA/RA/CE cert has changed, if cert is about to expire or CA/RA/CE cert has changed (Step D.1.b), CSO will send renew request.
   1. CSO uses ENROLLMENT request to enroll local cert from CA server, with saved local cert info from database (Step B.2) without password. Note: Since we do not store local cert in CSO, the request fails and moves to step D.2.b
   2. If failed, CSO uses ENROLLMENT request to enroll local cert from CA server again, with Certificate Signing Request (CSR) that includes the password.
4. NOTE: The above steps are the same as in C1, so nothing has changed here from CSO 6.2 behavior. The password is being passed in the same way for the ENROLLMENT.
5. CSO then pushes new local cert and CA cert, if changed from the above step to the device.