Scep

These scenarios show how to configure the SCEP protocol to retrieve certificates from a PKI server.

../../../../_images/scep.svg

Test SCEP Protocol With Linux PKI

Description

In this scenario, the SCEP protocol is used to retrieve digital certificates (X509) from a Linux PKI server.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 192.168.212.0/22 next-hop 10.215.168.1
set system certificate scep csr CSR cgi-path /scep
set system certificate scep csr CSR cipher aes
set system certificate scep csr CSR digest sha256
set system certificate scep csr CSR distinguished-names CN=MyUserCert
set system certificate scep csr CSR encrypted-password U2FsdGVkX1+eI06OxwvRtikBXyCVyK6WWq1y2EID7ZU=
set system certificate scep csr CSR port 8080
set system certificate scep csr CSR url 'http://10.215.168.1'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=1.10 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.102/1.102/1.102/0.000 ms

Step 3: Run the command pki scep show CSR on DUT0 and check whether the output matches the following regular expressions:

ca\s+Valid
usercert\s+Valid
Show output
-------------------------------------------------------------------------------------------------
Certificate  Status           Usage                   NotBefore                  NotAfter
-------------------------------------------------------------------------------------------------
ca           Valid   Encipherment & Signature  Apr 16 09:19:39 2025 GMT  Apr 11 09:19:39 2045 GMT
usercert     Valid   -                         Jul 24 14:08:27 2026 GMT  Jul 24 14:08:27 2027 GMT

Step 4: Run the command pki show certificate running://auth/certificates/scep/CSR/ca/ca.der on DUT0 and check whether the output contains the following tokens:

Subject: CN = Teldat-PKI, O = Teldat, L = Madrid, C = ES
Show output
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
7c:28:60:8a:6f:42:5d:c8:44:f0:10:0d:61:e5:ca:40:11:bc:ea:f2
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN = Teldat-PKI, O = Teldat, L = Madrid, C = ES
Validity
Not Before: Apr 16 09:19:39 2025 GMT
Not After : Apr 11 09:19:39 2045 GMT
Subject: CN = Teldat-PKI, O = Teldat, L = Madrid, C = ES
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:de:b7:3b:d9:9b:e3:d3:57:9b:b0:33:67:c0:40:
4f:45:84:ea:c2:35:a6:08:3b:3a:fd:6d:fa:d7:2b:
3d:7f:1c:a1:92:15:08:8b:5c:02:ec:6a:66:46:c5:
6f:7f:9b:9d:c3:86:e1:97:47:9b:5e:ea:96:5b:bf:
68:35:96:4f:6e:64:c6:7d:f6:da:6b:f9:bf:98:b1:
32:63:ae:f4:5b:2f:cd:6d:d7:ef:db:01:12:b0:a4:
54:95:6e:e8:84:4a:0a:f1:13:83:13:a1:7a:1d:f4:
06:3f:e3:53:5d:9f:68:a1:a0:5c:51:05:ba:8c:da:
00:11:64:4b:e8:37:c3:70:43:9c:16:dd:46:fb:34:
e4:3c:ae:a4:9a:a1:da:cf:a1:f5:93:13:a6:0e:68:
51:31:f7:26:63:a3:8b:47:c3:94:e4:34:d2:b0:36:
cf:22:e5:81:dd:a4:01:e8:79:08:37:ad:7a:b9:da:
24:37:cc:53:f4:51:f8:b5:67:09:15:63:52:60:7f:
b0:e2:f0:38:cd:3c:13:42:81:5f:e2:dd:e2:c5:37:
f3:ef:05:8c:85:2f:2a:0a:f4:94:2f:70:56:7f:7d:
a9:f6:ca:69:0b:a7:40:e1:fa:bc:f0:f4:01:7a:76:
55:f4:2a:57:43:8b:f1:87:58:f2:f4:db:23:26:33:
f8:4f
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
D3:97:2E:56:37:6A:89:77:01:D4:E3:42:0D:EC:E7:10:79:9C:E8:7C
X509v3 Authority Key Identifier:
keyid:D3:97:2E:56:37:6A:89:77:01:D4:E3:42:0D:EC:E7:10:79:9C:E8:7C
DirName:/CN=Teldat-PKI/O=Teldat/L=Madrid/C=ES
serial:7C:28:60:8A:6F:42:5D:C8:44:F0:10:0D:61:E5:CA:40:11:BC:EA:F2
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Key Usage: critical
Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
5e:0d:47:96:a2:24:38:fa:62:5b:0c:c2:4e:59:23:79:40:1b:
88:d1:63:11:0b:ce:bc:63:46:cd:70:33:52:75:4b:85:c1:39:
be:3c:ce:7c:66:53:63:b4:39:07:ec:ef:52:fe:fa:dc:c1:fb:
e4:51:61:28:58:4f:90:71:83:50:7d:62:a9:16:fa:45:89:08:
5f:39:43:6a:b1:bb:ad:4e:6f:50:bc:07:4f:1c:5b:07:df:63:
ec:44:20:48:b6:97:00:e2:9d:8e:42:9e:96:5f:71:7a:43:96:
de:fd:66:6b:45:85:5d:e4:dc:bf:e9:34:64:4f:3a:7b:33:a0:
54:80:3b:9a:5b:1f:3f:3f:1c:09:a3:8e:d8:b6:2a:ba:b2:07:
87:fa:0f:a5:69:41:06:b1:14:6f:09:4f:bb:88:60:87:70:83:
31:73:ed:2a:03:ca:3c:19:0a:b2:24:61:c6:ce:09:97:ac:6e:
da:cb:47:88:c5:f5:a7:74:d2:96:e0:cc:c3:b6:b7:f6:64:9f:
ad:1c:7f:36:fd:39:7c:57:54:a5:e9:8a:82:90:4d:cd:74:99:
27:4d:f6:62:a6:96:c5:6e:d3:02:ec:c1:4d:5f:46:b6:82:75:
12:61:d7:a3:d6:70:f6:35:9d:9c:30:06:84:af:b2:cb:a5:a0:
5e:d3:1d:6c

Step 5: Run the command pki show certificate running://auth/certificates/scep/CSR/user/cert on DUT0 and check whether the output contains the following tokens:

Subject: CN = MyUserCert
Show output
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 2 (0x2)
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN = Teldat-PKI, O = Teldat, L = Madrid, C = ES
Validity
Not Before: Jul 24 14:08:27 2026 GMT
Not After : Jul 24 14:08:27 2027 GMT
Subject: CN = MyUserCert
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:b8:5c:9e:54:3c:c7:42:4f:6c:00:ab:24:14:21:
c6:2b:cd:56:90:14:0c:4d:53:86:f7:50:72:c0:e0:
0b:93:78:b5:fe:0a:88:99:74:22:28:cd:60:f7:b7:
0e:19:8e:02:f5:26:67:8b:68:63:cb:a8:5f:83:61:
33:48:1e:12:19:72:1d:d6:f1:0d:cb:30:c6:ed:b5:
e3:a5:46:df:2e:64:fa:05:7d:c3:e1:10:7d:dc:ba:
a7:56:14:e1:1d:0c:42:43:ca:73:bf:48:c0:4e:9a:
3b:35:23:0c:f2:3b:e9:b7:3c:54:58:ad:23:e7:1a:
c3:0b:6f:63:b5:ea:e9:31:6c:af:a7:98:20:02:61:
ea:8a:bc:58:99:28:93:d1:f9:6c:ae:88:51:ec:20:
2b:a7:d4:2e:d4:aa:3a:4a:f0:38:11:54:4b:ed:a2:
08:63:bd:18:07:13:a8:65:ba:c8:b0:bb:fc:80:24:
03:3e:34:7d:e9:d6:cc:df:88:dc:57:62:93:fc:79:
ef:e6:9d:f7:13:05:e1:88:93:9c:59:d8:19:4e:d1:
a2:fa:b1:d1:5e:53:fa:25:2b:53:83:c3:84:ed:6d:
a2:03:48:69:97:e7:e6:b7:11:98:dc:1e:71:05:e7:
a2:6e:43:4d:78:a1:09:3c:3f:09:bc:eb:18:03:d3:
40:fd
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Subject Key Identifier:
A4:64:22:D1:09:BB:7B:E6:3E:D6:A1:07:D9:BC:3B:DC:EC:F0:95:0D
X509v3 Authority Key Identifier:
D3:97:2E:56:37:6A:89:77:01:D4:E3:42:0D:EC:E7:10:79:9C:E8:7C
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
53:39:52:cc:59:8f:3c:97:9b:ab:03:9b:83:09:09:ad:02:66:
7d:26:a0:1e:4a:96:f1:9d:3d:a3:f5:c4:40:1a:16:80:fc:8e:
a8:47:a5:9c:06:30:88:9b:27:94:98:06:6e:3b:8f:e0:0f:38:
32:49:89:46:5f:da:e5:d2:2d:b2:7e:d0:f9:1c:99:bb:c0:b8:
6c:4c:52:6c:be:53:55:a3:b1:39:0b:87:89:72:d5:3d:a8:2c:
4f:74:b1:c0:b4:81:b1:89:d0:d6:44:84:32:a2:42:d1:fa:06:
b5:8b:58:a1:7b:73:36:e6:0c:0f:9b:d8:8b:5f:43:8e:6a:f5:
57:b2:00:b4:78:57:11:82:6f:b1:18:20:d8:18:ef:cc:17:5b:
1f:e7:b0:21:2e:61:2e:8f:16:76:08:d3:d4:2c:e6:dd:28:ab:
0c:9d:ad:8e:38:8b:72:46:b5:a4:22:5e:76:2f:57:37:20:44:
bd:8f:17:85:47:ab:41:02:e2:07:4a:dc:b0:60:81:11:f2:66:
e1:ab:9b:1f:63:e3:d1:fb:f3:e8:54:f2:88:e8:6a:3a:b6:7c:
04:77:a6:74:68:3d:6c:82:35:97:68:47:dd:b6:85:8f:7e:f5:
48:85:1e:a6:35:2c:df:a8:e6:03:77:d4:55:6c:3e:3b:5e:60:
b1:9b:4b:b9

Test SCEP Protocol With Windows Server PKI

Description

In this scenario, the SCEP protocol is used to retrieve digital certificates (X509) from a Windows PKI server.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 192.168.212.0/22 next-hop 10.215.168.1
set system certificate scep csr CSR cgi-path CertSrv/mscep/mscep.dll/pkiclient.exe
set system certificate scep csr CSR distinguished-names CN=MyUserCert
set system certificate scep csr CSR encrypted-password U2FsdGVkX1+P/HCirHRRYu8Mjm0d/VR4bwt6wSwPgJ3oAJas4zdTyObh0DeWrNiFjRZrLPaht8WobcmE7F7VzA==
set system certificate scep csr CSR url 'http://192.168.213.25/'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.293 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.293/0.293/0.293/0.000 ms

Step 3: Ping the IP address 192.168.213.25 from DUT0:

admin@DUT0$ ping 192.168.213.25 count 1 size 56 timeout 1
Show output
PING 192.168.213.25 (192.168.213.25) 56(84) bytes of data.
64 bytes from 192.168.213.25: icmp_seq=1 ttl=126 time=1.02 ms

--- 192.168.213.25 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.018/1.018/1.018/0.000 ms

Step 4: Run the command pki scep show CSR on DUT0 and check whether the output matches the following regular expressions:

ca\s+Valid
usercert\s+Valid
Show output
-------------------------------------------------------------------------------------
Certificate  Status     Usage             NotBefore                  NotAfter
-------------------------------------------------------------------------------------
ca           Valid   Signature     Jan  9 09:34:41 2026 GMT  Jan  9 09:44:41 2056 GMT
ra           Valid   Encipherment  Jan  9 09:37:26 2026 GMT  Jan  9 09:37:26 2028 GMT
ra-2         Valid   Signature     Jan  9 09:37:25 2026 GMT  Jan  9 09:37:25 2028 GMT
usercert     Valid   -             Jul 24 13:35:50 2026 GMT  Jul 24 13:45:50 2028 GMT

Step 5: Run the command pki show certificate running://auth/certificates/scep/CSR/ca/ca.der on DUT0 and check whether the output contains the following tokens:

Subject: DC = com, DC = scep, CN = scep-TELDATPKI-CA
Show output
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
2e:aa:77:9e:fd:8d:47:8d:42:5f:96:57:64:8a:da:d1
Signature Algorithm: sha256WithRSAEncryption
Issuer: DC = com, DC = scep, CN = scep-TELDATPKI-CA
Validity
Not Before: Jan  9 09:34:41 2026 GMT
Not After : Jan  9 09:44:41 2056 GMT
Subject: DC = com, DC = scep, CN = scep-TELDATPKI-CA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:be:22:9c:cd:53:99:06:1b:31:57:cd:72:1b:d7:
5d:99:b4:e2:e1:88:80:d4:40:53:49:be:ff:e0:5b:
8b:41:8c:96:e8:99:cd:19:ab:98:4c:99:77:ad:01:
fc:51:cf:ea:d8:43:fc:5b:d2:dd:b5:05:04:ae:01:
28:e9:53:5d:bb:d2:65:71:d9:69:3c:04:4d:6b:6e:
8b:95:92:e4:e7:84:57:90:b3:5e:1f:76:34:7f:15:
e2:fb:c0:78:bb:ec:a5:be:2f:33:9e:98:06:f1:4c:
1f:cc:ee:85:c2:f1:8f:3c:23:52:a2:94:af:0e:b8:
d2:e3:0c:b7:07:49:b9:91:87:3e:76:89:61:f0:88:
4c:2f:da:6b:b9:75:93:6e:e4:e2:f1:19:48:00:f7:
af:1b:70:19:15:2b:30:b3:78:24:dc:14:c4:e8:a0:
61:f9:68:09:7d:e9:3e:6f:e0:a3:44:d5:43:f8:78:
aa:5f:a8:7a:3a:7c:2c:4e:21:69:24:be:2f:cb:57:
bd:60:e8:b9:a5:3b:ad:0c:7b:d9:8d:82:3e:13:96:
8b:59:5a:2b:ec:b6:63:33:21:69:a5:30:b6:bb:84:
e9:80:8d:db:3c:94:f7:52:05:76:6a:ed:d6:03:24:
d8:97:46:a4:15:41:4d:17:98:7d:20:64:ac:fb:e9:
30:1d
Exponent: 65537 (0x10001)
X509v3 extensions:
1.3.6.1.4.1.311.20.2:
...C.A
X509v3 Key Usage: critical
Digital Signature, Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Key Identifier:
18:DA:43:2C:11:47:FC:1A:DA:19:D4:6C:8B:2D:58:AA:75:ED:17:94
1.3.6.1.4.1.311.21.1:
...
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
3b:f8:53:b9:17:78:98:fa:4a:63:a8:5b:57:bc:f6:67:d8:47:
48:8a:22:2f:d8:39:22:44:c9:f8:aa:fd:e8:81:13:c4:5f:9b:
b2:72:0a:35:b1:0c:64:ff:ff:89:05:f0:d7:2a:e4:5f:da:6b:
7b:90:88:5e:6c:77:e5:17:83:19:43:10:35:f8:b5:e3:b8:b5:
16:c1:79:5e:cc:71:00:91:6a:aa:b7:7e:e8:35:99:b3:74:c1:
b7:d9:93:8c:6b:4e:64:5a:0a:aa:09:ce:00:d6:f2:f0:f6:87:
ec:cd:dc:d0:07:d5:cb:6d:7f:34:72:80:7b:8c:71:f3:d8:f6:
a4:38:45:0e:19:79:bd:07:d6:91:a0:4f:4f:2e:55:f1:ca:f7:
f3:b1:94:33:7b:f0:76:2b:10:d6:9b:49:ef:96:83:f3:f5:2e:
b3:c4:48:13:2f:19:f3:18:7f:4c:7a:09:79:3b:52:94:d9:86:
65:58:32:34:ba:89:6e:54:99:ab:12:7b:f5:3d:61:f3:39:22:
08:ef:7b:77:ba:95:7e:8e:ca:51:4d:80:45:2b:43:d8:b1:37:
fb:0c:69:7a:c8:5c:dc:4c:16:5f:a1:09:5c:d6:85:ed:93:76:
fa:56:67:fe:fc:97:3c:8d:f8:3c:39:d7:31:07:e6:69:42:3d:
3d:d2:86:1e

Step 6: Run the command pki show certificate running://auth/certificates/scep/CSR/user/cert on DUT0 and check whether the output contains the following tokens:

Subject: CN = MyUserCert
Show output
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
11:00:00:29:01:84:9b:43:9d:66:b4:bd:34:00:00:00:00:29:01
Signature Algorithm: sha256WithRSAEncryption
Issuer: DC = com, DC = scep, CN = scep-TELDATPKI-CA
Validity
Not Before: Jul 24 13:35:50 2026 GMT
Not After : Jul 24 13:45:50 2028 GMT
Subject: CN = MyUserCert
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:ce:a3:4a:44:9a:38:9a:e6:2b:8d:a6:51:7d:3a:
c7:d4:25:54:e4:79:c5:1e:d5:72:41:29:4b:b4:5f:
3f:7e:7b:40:c0:46:d7:49:f2:9e:fb:68:14:4e:e4:
65:b7:b3:67:fc:5d:04:ba:fb:27:a7:a8:f2:4a:12:
a7:c0:d9:05:fd:8d:a5:33:8e:4f:a8:ef:d7:ec:44:
c2:df:df:b9:9a:81:ce:1d:8f:c2:00:47:8a:52:bd:
d6:f7:43:d2:ea:98:36:5a:62:18:b6:4f:b0:57:20:
b7:bb:a8:46:c2:4a:e2:8e:2e:21:b6:1a:e8:1b:13:
6f:18:40:0d:8f:0c:21:83:8d:39:fa:c6:f8:09:1d:
f8:c7:0d:29:72:e2:fc:bb:8d:61:03:60:4c:e9:d9:
9b:48:ce:bb:00:8f:da:2a:62:62:a1:3d:5a:71:0a:
21:84:09:7f:96:42:b6:67:56:f2:cc:68:54:a9:65:
18:58:a5:67:94:c7:c6:d2:93:64:89:d1:33:07:08:
bb:b0:9e:60:30:e1:2a:d7:61:7c:9e:b4:b9:a2:e3:
fd:81:da:01:64:ba:fc:49:69:41:2e:bb:44:24:c9:
0c:a2:f0:2f:32:a5:4f:8a:34:80:a7:13:47:08:a8:
bd:0a:0e:d2:dc:ad:53:96:cc:64:be:ac:1b:9f:cb:
ae:6b
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
A9:F3:ED:20:88:D9:00:E4:A9:62:38:DF:0C:5E:DA:7C:8E:C4:E6:DD
X509v3 Authority Key Identifier:
18:DA:43:2C:11:47:FC:1A:DA:19:D4:6C:8B:2D:58:AA:75:ED:17:94
Authority Information Access:
CA Issuers - URI:ldap:///CN=scep-TELDATPKI-CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=scep,DC=com?cACertificate?base?objectClass=certificationAuthority
X509v3 Key Usage: critical
Digital Signature, Key Encipherment, Data Encipherment
1.3.6.1.4.1.311.21.7:
0..&+.....7.....3......./...(...f<...[...]..d...
X509v3 Extended Key Usage:
1.3.6.1.4.1.311.20.1, Microsoft Encrypted File System, Code Signing, Any Extended Key Usage, TLS Web Server Authentication, Signing KDC Response, TLS Web Client Authentication, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.20.2.1, 1.3.6.1.5.5.8.2.2
1.3.6.1.4.1.311.21.10:
0y0...+.....7..0..
+.....7
..0
..+.......0...U.%.0
..+.......0...+......0
..+.......0...+.....7..0..
+.....7...0
..+.......
S/MIME Capabilities:
050...*.H..
......0...*.H..
......0...+....0
..*.H..
..
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
b4:e3:0b:e8:b5:2c:c1:41:23:2b:5b:71:5d:26:4d:b6:fa:ee:
c2:86:71:9a:3e:a9:b4:9f:f0:c7:2b:24:c6:f6:30:c9:be:a1:
59:f6:9f:e2:68:43:17:0b:c2:71:82:8d:19:10:f4:15:93:6d:
6f:96:02:80:c0:ce:4a:26:99:82:34:24:9b:7a:4d:ba:80:d0:
60:06:ff:be:93:16:54:68:8c:19:95:02:03:4f:40:13:24:03:
24:ad:dd:c7:d1:57:23:f2:5c:4e:89:5b:cf:a0:6c:26:91:c6:
f3:1e:3a:05:6f:46:4b:41:32:23:9e:db:1f:e9:80:87:0f:6b:
e2:00:72:ae:8f:7d:4c:08:dd:9d:c8:c3:8d:0d:23:21:d2:20:
d1:1c:ea:0b:71:93:20:57:66:3d:d9:82:30:57:4b:e3:85:43:
e9:68:f1:ba:bd:b5:fd:09:fd:f5:fa:69:34:13:f1:2b:ee:32:
5c:4e:cd:d4:18:89:f6:2e:40:87:ea:cf:6d:3e:f6:84:f8:3e:
b8:06:66:fd:e8:07:ee:60:b8:bc:b2:38:52:8d:f1:69:fc:9e:
a5:bd:aa:9b:fa:27:90:36:1c:1d:5e:81:af:d6:74:88:93:26:
3b:a0:c4:41:61:f8:00:49:15:b3:16:61:10:a6:47:83:96:db:
2c:d9:9a:85