issue SCEP certs using 2 as the initial SerialNumber (#9087)

Related to #8167, from RFC5280:

> The serial number MUST be a positive integer assigned by the CA to
> each certificate. It MUST be unique for each certificate issued by a
> given CA (i.e., the issuer name and serial number identify a unique
> certificate).

Without this change, we're issuing two different certificates with the
same serial number (1, one) and issuer name:

1. One during `fleetctl generate mdm-apple`
1. One during the first SCEP enrollment

changes/8167-scep-serials

@@ -0,0 +1 @@
+- Fixed an issue that made the first SCEP enrollment during the MDM check-in flow fail in a new setup.

server/datastore/mysql/migrations/tables/20221220195934_SetSCEPSerialsAutoIncrement.go

@@ -0,0 +1,37 @@
+package tables
+
+import (
+	"database/sql"
+
+	"github.com/pkg/errors"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20221220195934, Down_20221220195934)
+}
+
+func Up_20221220195934(tx *sql.Tx) error {
+	var count int
+	err := tx.QueryRow("SELECT COUNT(*) FROM scep_serials").Scan(&count)
+	if err != nil {
+		return errors.Wrap(err, "count scep_serials")
+	}
+
+	// if the database already has serials, don't change the auto
+	// increment.
+	if count > 0 {
+		return nil
+	}
+
+	// Start assigning serials from 2, as we assume the first serial
+	// is issued to the CA.
+	//
+	// See https://github.com/fleetdm/fleet/issues/8167 for more
+	// details.
+	_, err = tx.Exec("ALTER TABLE `scep_serials` AUTO_INCREMENT = 2")
+	return errors.Wrap(err, "set scep_serials auto increment")
+}
+
+func Down_20221220195934(tx *sql.Tx) error {
+	return nil
+}

server/datastore/mysql/migrations/tables/20221220195934_SetSCEPSerialsAutoIncrement_test.go

@@ -0,0 +1,22 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20221220195934(t *testing.T) {
+	db := applyUpToPrev(t)
+	var count int
+	err := db.Get(&count, "SELECT COUNT(*) FROM scep_serials")
+	require.NoError(t, err)
+	require.Equal(t, 0, count)
+	applyNext(t, db)
+
+	execNoErr(t, db, "INSERT INTO scep_serials () VALUES ()")
+	var serial int
+	err = db.Get(&serial, "SELECT serial FROM scep_serials")
+	require.NoError(t, err)
+	require.Equal(t, 2, serial)
+}

server/mdm/apple/scep_mysql_test.go

@@ -0,0 +1,70 @@
+// use a different package name to avoid
+// import cycle
+package apple_mdm_test
+
+import (
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"math/big"
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
+	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
+	"github.com/micromdm/nanodep/tokenpki"
+	"github.com/stretchr/testify/require"
+)
+
+func setup(t *testing.T) *apple_mdm.SCEPMySQLDepot {
+	ds := mysql.CreateNamedMySQLDS(t, t.Name())
+	cert, key, err := apple_mdm.NewSCEPCACertKey()
+	require.NoError(t, err)
+	publicKeyPEM := tokenpki.PEMCertificate(cert.Raw)
+	privateKeyPEM := tokenpki.PEMRSAPrivateKey(key)
+	depot, err := ds.NewMDMAppleSCEPDepot(publicKeyPEM, privateKeyPEM)
+	require.NoError(t, err)
+	return depot
+}
+
+func TestAppleMDMSCEPSerial(t *testing.T) {
+	depot := setup(t)
+	tests := []struct {
+		name    string
+		want    *big.Int
+		wantErr bool
+	}{
+		{
+			name: "two is the default value.",
+			want: big.NewInt(2),
+		},
+	}
+	for _, tt := range tests {
+		got, err := depot.Serial()
+		require.NoError(t, err)
+		require.Equal(t, tt.want, got)
+	}
+}
+
+func TestAppleMDMPutAndHasCN(t *testing.T) {
+	depot := setup(t)
+
+	name := "FleetDM Identity"
+	serial, err := depot.Serial()
+	require.NoError(t, err)
+	cert := x509.Certificate{
+		SerialNumber: serial,
+		Subject: pkix.Name{
+			CommonName: name,
+		},
+	}
+
+	err = depot.Put(name, &cert)
+	require.NoError(t, err)
+
+	has, err := depot.HasCN(name, 0, &cert, false)
+	require.NoError(t, err)
+	require.True(t, has)
+
+	has, err = depot.HasCN("non-existent", 0, &cert, true)
+	require.NoError(t, err)
+	require.False(t, has)
+}