SCEP

SCEP, or Simple Certificate Enrollment Protocol, is a network protocol used to enroll and obtain X.509 digital certificates from a Certificate Authority (CA) in an automated fashion. It is commonly deployed in enterprise networks and on network devices, mobile devices, and some servers to enable TLS, VPN, or code-signing certificates without manual certificate provisioning. The protocol is standardized in IETF as SCEP.

Workflow: A client first obtains the CA’s certificate(s) so it can validate the CA. It then generates a private key and a certificate signing request (CSR) containing its subject name and any optional attributes such as a challenge password. The client constructs an enrollment request that includes the CSR (in PKCS#10 form) and transmits it to the CA’s enrollment server over HTTP or HTTPS. If the request is authorized, the CA issues a certificate and returns it to the client in a response (often within a CMS/PKCS#7 payload). In some deployments, the client may poll for the result using a transaction identifier. The client then installs the certificate and may update the CA certificate chain, CRLs, and certificate renewals.

Security and limitations: SCEP relies on secure transport and sometimes on a pre-shared challenge password or client authentication to authorize enrollment. It has known weaknesses, including reliance on relatively weak authentication, potential for certificate replay, and exposure when used over unencrypted channels or with poor CA validation. Modern deployments increasingly prefer Enrollment over Secure Transport (EST) or other protocols that provide stronger authentication and integrity.

Adoption and context: SCEP remains widely used, particularly in the provisioning of network devices and on-premises systems, due in part to vendor support and simplicity. However, EST or other modern protocols are often recommended for new deployments.