# Certificate

Last updated: August 14, 2026

This page explains how to configure a Windows Certificate Profile in MDM to deploy server CA certificates to managed Windows devices. Learn how pushing certificates helps secure and validate network communications, enabling trusted access to internal or external networks, servers, and email services such as S/MIME. The supported certificate formats include .cer, .crt, .pem, and .der. For large organizations requiring scalable certificate distribution, the page also references the Simple Certificate Enrollment Protocol (SCEP) as an alternative approach.

Certificate policy lets you deploy server CA certificates to secure and configure features such as Wi-Fi, E-mail, etc., on the managed devices. This policy is used to deploy certificates to windows devices, ideally to **secure and validate network communications** from the device to any internal/external website. By pushing certificates to device, you can secure access to networks/servers, secure e-mail communication, etc., For example, you can deploy CA certificates to the managed devices, if your organization uses S/MIME to connect to a network/server. The certificates pushed to the device ensures the devices trust the enterprise CA. **The supported certificate formats are .cer, .crt, .pem, and .der**.

**Note:** For scalable and simplified distribution of certificates in large organizations, you can configure [Simple Certificate Enrollment Protocol (SCEP)](https://www.manageengine.com/mobile-device-management/help/profile_management/windows/mdm_windows_scep.html)

## Profile Description

| Profile Specification | Description |
|---|---|
| Certificate File | The file to be pushed to the managed devices. |

1. The certificates are added only if the certificate files are not corrupt.
2. On certificate expiry, upload the renewed certificate as a new certificate in the profile and then push it to the managed devices.

## Frequently Asked Questions

**Which certificate file formats does the Certificate profile support?**

The supported certificate formats are .cer, .crt, .pem, and .der.

**What's the difference between the Certificate profile and SCEP?**

The Certificate profile pushes CA certificates directly to managed devices, while SCEP provides scalable, automated distribution of client certificates for large organizations.

**What happens when a pushed certificate is about to expire?**

Upload the renewed certificate as a new certificate in the profile and push it to the managed devices; certificates are only added if the certificate files aren't corrupt.