Topic starter
06/11/2026 6:55 pm
TL;DR: SCEP automates device certificate enrolment, according to AppViewX's analysis of the protocol's limits. For practitioners, the real work starts after issuance, when inventory, renewal, revocation and trust monitoring must be governed elsewhere.
Editorial analysis by NHI Mgmt Group, based on content published by AppViewX: “What is SCEP (Simple Certificate Enrollment Protocol)?”.
Key questions
Q: Why do shared enrollment passwords create certificate risk?
A: Shared enrollment passwords create certificate risk because any holder can request a device certificate, so the certificate authority cannot reliably distinguish legitimate enrollment from unauthorised issuance.
Q: How should teams govern certificate lifecycle for access control?
A: Teams should treat certificate lifecycle as an identity control, not an infrastructure afterthought.
Q: How does SCEP work for device certificate enrolment?
A: SCEP lets a device request a certificate by generating a key pair locally, building a CSR and sending it to a CA or registration authority with a shared enrollment secret.
Practitioner guidance
- Tighten enrollment secret handling Use unique, single-use enrollment passwords where SCEP is still required, and shorten their validity window so leaked secrets have less utility.
- Bind issuance to authoritative device inventory Approve certificate requests only when the device matches an inventory record, ownership is known and the request fits an approved lifecycle state.
- Centralise certificate renewal and revocation Track every issued certificate in one inventory so renewal timing and revocation decisions do not depend on scattered local processes.
Bottom line: SCEP is useful for device certificate issuance, but it leaves the hardest governance questions outside the protocol itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
SCEP creates a lifecycle debt, not a governance model. The protocol is good at getting a certificate issued, but it leaves the organisation to solve ownership, renewal, revocation and inventory elsewhere. That means the control boundary begins at enrollment and immediately hands off the hard part to downstream process discipline. Practitioners should stop treating enrollment success as the same thing as certificate governance.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between SCEP and EST for device certificates?
A: SCEP is an older certificate enrolment protocol that commonly uses a shared secret or static challenge password, while EST uses HTTPS and can support stronger device authentication with client certificates and existing PKI trust. EST is generally better suited to modern managed devices because it gives a stronger enrolment channel and clearer identity binding for certificate issuance.
👉 Read our full editorial: SCEP leaves certificate lifecycle risk outside enrollment