Last updated: August 13, 2026
Integrating Generic SCEP server with MDM
This page explains how to integrate a Generic SCEP server with MDM to automate certificate deployment across managed devices. IT admins will learn how to configure a CA server using Simple Certificate Enrollment Protocol, create certificate templates with user-specific attributes and challenge-type authentication, and build SCEP profiles for distribution to Apple, Android, and Windows devices. The guide covers key settings including subject configuration, key size, auto-renewal, and challenge password, enabling large-scale, silent certificate provisioning and renewal.
Using Generic SCEP integration, IT admins can leverage Simple Certificate Enrollment Protocol for securely deploying certificate enrollment requests to devices using MDM. MDM can be integrated with your CA server to dynamically create user-specific certificates and distribute certificates at large scale, facilitating high volume deployment of certificates by automatically provisioning, renewing and silently installing certificates on devices.
Configuring SCEP in MDM
Follow the steps given below to configure SCEP in MDM
- On the MDM console, navigate to Device Mgmt -> Certificates
- Click on the CA Servers tab and click on Add CA server
- Provide the following details:
| Profile Specification | Description |
|---|---|
| Server Type | Specify server type as Generic SCEP. |
| Certificate Authority Name | Specify the name of the Certificate Authority issuing certificates. |
| Server URL | The URL to be specified in the device to obtain certificate. Provide HTTP Server URL, if the SCEP server is within the organization network and not exposed to external networks. The certificate is requested through this URL. |
| Add CA Certificate | Upload the Certificate Authority's certificate |
Creating templates for the CA servers
For creating user-specific certificates, a template needs to be configured based on which all the certificates will be issued by the CA.
Follow the steps given below to configure the template on MDM:
- Navigate to Device Mgmt -> Certificates.
- Click on Templates tab and click on Add Templates
- Select the server to which the template belongs. In this case, select the Generic SCEP server that was previously added
- Provide the following details:
| Profile Specification | Description |
|---|---|
| Certificate Template Name | Specify the certificate template name. |
| Subject | Specify the Subject DN that needs to be present in the certificate. You can use dynamic keys such as %username%, %email%, %firstname% to fetch the the corresponding details mapped to the device. For instance, you can enter C=US,O=Zylker,OU=Zylker,CN=%firstname%. |
| Subject Alternative Name Type | Specify one of the following values, None, RFC 822 Name, DNS Name or Uniform Resource Identifier for the subject alternative name type. |
| Subject Alternative Name Value (Can be configured only if Subject Alternative Name Type is configured) | Specify a value for subject alternative name value. The value to be entered can include DNS name, URI or email. For instance, you can use the dynamic key %email% for email. |
| NT Principal Name | Specify the NT Principal Name used in the organization. |
| Wipe device after specified number of failed attempts | Specify the maximum number of failed validation attempts allowed to obtain the certificate from the CA. Once the maximum limit is exceeded, users will be temporarily restricted from attempting to vaildate the user account. |
| Time interval between attempts | Time to wait before subsequent attempts to obtain the certificate |
| Challenge Type | A pre-shared secret key provided by the CA, which adds additional layer of security. If Static is chosen, the challenge password will be submitted to the SCEP server for authentication. If None is chosen, no authentication is requested by the SCEP server and any device can receive the certificate by accessing the SCEP URL. |
| Enrollment Challenge Password (Can be configured only if Static challenge type is selected) | Provide the challenge password to be used. All the devices will use the specified password for authentication. |
| Key Size | Specify whether the key is 1024 or 2048 bits |
| Use as Digital Signature | Enabling this option ensures the certificate can be used for Digital Signature |
| Use for Key Encipherment | Enabling this option ensures the certificate can be used for Key Encipherment |
| Certificate Auto Renewal | Enabling this option ensures the certificates are renewed automatically before it expires. |
| Certificate Automatic Renewal Before | Specify the number of days before which the the certificate must be auto-renewed. |
Creating a SCEP profile
To distribute certificates to managed devices, a SCEP profile need to associated with these devices. Follow the steps given below to create and associate the SCEP profile to devices
- Navigate to Device Mgmt -> Profiles and create either an Apple, Android or Windows profile.
- Select SCEP from the left pane.
- Select the created Certificate template.
- Click on Save and publish the profile.
It is recommended to distribute the profile to a device for testing before distributing it to your production environment. Once testing is complete, you can distribute the profile to your production environment using Groups.
Frequently Asked Questions
1. Which device platforms can receive certificates via a Generic SCEP profile?
Generic SCEP profiles can be created and distributed to Apple, Android, and Windows devices.
2. Can the Generic SCEP server be kept internal, without exposing it externally?
Yes. When configuring the Server URL, you should provide the HTTP Server URL if the SCEP server is within your organization network and is not exposed to external networks.
3. What happens when the configured maximum number of failed attempts is exceeded?
Users are temporarily restricted from attempting to validate their account once the maximum limit of failed validation attempts is exceeded, until the configured time interval between attempts has passed.
4. What does the Challenge Type setting control?
Challenge Type adds an extra layer of security using a pre-shared secret key from the CA. Choosing Static requires the challenge password to be submitted for authentication, while choosing None means any device can receive the certificate by accessing the SCEP URL without additional authentication.