Configuring SCEP Settings

The SCEP payload automates the secure delivery of digital certificates to managed devices at scale. Instead of relying on vulnerable, shared pre-shared keys (PSKs) or manually installing identity profiles, SCEP allows devices to silently request unique cryptographic certificates from a corporate Certificate Authority (CA). These certificates are commonly used to authenticate devices for secure Wi-Fi networks, enterprise VPNs, or internal portals.

Configuration Steps

• Select Profiles from the left-hand navigation panel and click the Edit (Pencil) icon next to your target profile.
• Navigate to the What tab on the profile configuration screen.
• Select the Networks option, and you will find SCEP

• Select Add New and configure the required settings.

Step 1: Core SCEP Server Details

• URL (Required): Enter the base HTTP/HTTPS URL for your SCEP server (e.g., http://scep.yourdomain.com/certsrv/mscep/mscep.dll).
• Name: Enter the CA instance identifier name (CA-IDENT) used to distinguish this certificate issuer.
• Subject: Define the X.500 name representation for the certificate payload (e.g., CN=%UserEmail%,O=Your Organization,C=US). You can often use Mobile Guardian wildcards here depending on your directory integration.

Step 2: Subject Alternative Name (SAN) & Principal Identity

If your network infrastructure requires additional identification factors (like matching an email or hardware ID):

• Subject Alternative Name Type: Select the type of alternate identity parameter from the dropdown:
  • None
  • RFC 822 Name (Typically used for email addresses)
  • DNS Name (Typically used for fully qualified domain names)
  • Uniform Resource Identifier (URI)
• Subject Alternative Name Value: Input the corresponding value or MDM variable mapping to match the chosen SAN type.
• NT Principal Name (Optional): Enter the User Principal Name (UPN) to be embedded in the certificate request, heavily utilised for Microsoft Active Directory authentications.

Step 3: Polling & Retry Rules

Managed devices query the SCEP server to see if a certificate has been signed. Set your server communication boundaries here:

• Retries: Input the maximum number of times the device should poll the SCEP server for a signed certificate before failing the enrollment attempt.
• Retry Delay: Input the duration (in seconds) the device should wait between each polling attempt.

Step 4: Challenge Security & Credentials

• Challenge: Enter the pre-shared secret (challenge password) required by your SCEP server to validate that the certificate request is coming from a trusted, authorised source.
• Username: Input the username required to authenticate and fetch the challenge secret.
• Password: Input the password required to authenticate and fetch the challenge secret.

Step 5: Cryptography & Key Usage Options

• Key size: Select the cryptographic key length in bits from the dropdown: 1024, 2048, or 4096.
  ⚠️ Compatibility Note: Key size 4096 is not supported on devices running legacy versions such as iOS 13. For the widest compatibility across older models, 2048 is the industry standard.
• Use as digital signature: Check this box to allow the issued certificate to sign data (verifying identity/tamper-proofing).
• Use for key encipherment: Check this box to allow the certificate to encrypt cryptographic keys used during secure network handshakes.

Step 6: Save

Click Save at the bottom of the section to attach this SCEP rule to the profile.

Settings Quick Reference