Hi @raelynn,
For an on-premises Microsoft AD CS/NDES setup, there are two possible approaches depending on how certificates need to be issued.
If you use a direct SCEP/NDES endpoint, the endpoint must be reachable by the devices that request certificates. If devices need to request or renew certificates while outside the corporate network, the SCEP endpoint or reverse proxy must be reachable over HTTPS from the internet. If certificate deployment happens only when devices are on the internal network or connected through VPN, public exposure is not mandatory.
For Microsoft AD CS environments, you can also use the Hexnode AD CS Connector, also referred to as the PKI Agent or Cloud Broker. This is installed on an internal server and brokers communication between Hexnode and the on-premises AD CS infrastructure using outbound connectivity, so the CA/NDES endpoint does not need to be exposed directly to the public internet.
For Android and iOS certificate deployment, the Hexnode AD CS Connector is supported and would be the recommended option if you want to avoid exposing the SCEP server externally. The connector also supports macOS certificate deployment. Windows certificate deployment through the AD CS Connector is not currently supported.
If you choose to expose the SCEP/NDES endpoint instead, place it behind HTTPS and restrict inbound access at the firewall or reverse proxy to the applicable Hexnode server IP addresses wherever possible.
Regards,
Sienna Carter
Hexnode UEM
What's new 
27 Views
