Skip Navigation

Using SCEP to send client certificates to devices

You can use SCEP profiles to specify how 
Windows 10
 devices obtain client certificates from your organization's CA through a SCEP service. SCEP is an IETF protocol that simplifies the process of enrolling client certificates to a large number of devices without any administrator input or approval required to issue each certificate. Devices can use SCEP to request and obtain client certificates from a SCEP-compliant CA that is used by your organization. The CA that you use must support challenge passwords. The CA uses challenge passwords to verify that the device is authorized to submit a certificate request.
Depending on the device capabilities and activation type, devices can use the client certificates obtained using SCEP for certificate-based authentication from the browser or to connect to a work 
 network, work VPN, or work mail server.
If your organization uses an 
 CA or 
 CA, SCEP profiles are not supported for 
Windows 10