# Configure SCEP for iOS Devices in Hexnode UEM Simple Certificate Enrollment Protocol (SCEP) automates digital certificate enrollment for Apple iPhone and iPad devices managed through the iOS SCEP policy in Hexnode UEM. SCEP lets a managed device request a client certificate from a Certificate Authority (CA), receive the certificate, and install it without manually distributing certificate files. IT administrators use this workflow to issue identity certificates for Wi-Fi, VPN, and Email authentication so that trusted, managed devices can access corporate services. In Hexnode UEM, the SCEP policy stores the enrollment settings and deploys them to selected devices, users, groups, or directory targets. The device uses those settings to communicate with the configured CA, generate the certificate request, and install the returned certificate. How SCEP Certificate Enrollment Works for iOS Devices in Hexnode UEM -------------------------------------------------------------------- The SCEP payload in Hexnode UEM defines how an iOS device reaches the SCEP server and how the certificate request should be authenticated. The device receives the policy, generates the private key locally, submits the certificate request to the CA, and installs the issued certificate after the CA approves or returns the request. The deployed certificate can be used as an identity certificate in supported authentication workflows, such as Wi-Fi and VPN policies. Use wildcards in the Subject or Subject Alternative Name fields when the certificate identity must include device or user attributes stored in Hexnode UEM. Configure SCEP for iOS Devices in Hexnode UEM --------------------------------------------- To create an iOS SCEP policy in the Hexnode UEM portal: 1. Log in to the **Hexnode UEM portal**. 2. Go to **Policies > New Policy > Create a fully custom policy > iOS > Security > SCEP**. 3. Click **Configure**. Select the Certificate Authority Provider for iOS SCEP ------------------------------------------------------ Select the provider type that matches the certificate infrastructure used by the organization. - **Microsoft CA (AD CS):** Select this option when using Microsoft Active Directory Certificate Services. - **Generic:** Select this option when using a third-party Certificate Authority that supports the SCEP protocol. Configure Microsoft CA (AD CS) SCEP Settings for iOS ---------------------------------------------------- Use the following settings when the iOS SCEP policy in Hexnode UEM integrates with a Microsoft CA environment. Microsoft CA (AD CS) SCEP configuration settings for iOS devicesConfigurationDescriptionServer typeSpecify the Microsoft CA hosting environment. - **On-prem:** The Microsoft CA is within the organization’s on-premises infrastructure. - **Cloud:** The Microsoft CA is hosted in a cloud environment. Server URLThe SCEP service URL used to request and receive client certificates. This URL is included in the device profile so the device can obtain certificates.SubjectEnter the X.500 name used to identify the certificate entity, such as **C=Country**, **ST=State**, or **O=Organization Name**. This field supports [Hexnode UEM wildcards](https://www.hexnode.com/mobile-device-management/help/how-to-pass-device-and-user-information-using-the-wildcards-supported-by-hexnode-mdm/).Challenge typeChoose how the device authenticates the SCEP certificate request. - **Microsoft SCEP (mscep) – Password** - **Microsoft SCEP (mscep) – URL** - **None** ChallengeThis field appears when **Microsoft SCEP (mscep) – Password** is selected. Enter the password used to authenticate the certificate request.AgentSelect the AD agent that connects to the SCEP server or URL. This setting is required for **On-prem** CAs to help devices request certificates. If the AD agent is not listed, [configure the Hexnode UEM AD agent settings](https://www.hexnode.com/mobile-device-management/help/microsoft-active-directory-integration-with-hexnode-mdm/#).Challenge URLThis field appears when **Microsoft SCEP (mscep) – URL** is selected. Enter the CA-provided URL where the device retrieves a one-time challenge password.UsernameEnter the username for the SCEP CA.PasswordEnter the password for the SCEP CA.Key sizeSelect **1024** or **2048** bits. The default key size is **1024**.Key typeSelect the key encryption type. The currently supported key type is **RSA**.Key used forSpecify whether the key is used for **Signing**, **Encryption**, or both, if supported by the CA.Number of automatic retriesEnter the number of retry attempts when the server response is pending.Retry delay (in seconds)Enter the number of seconds between subsequent retry attempts.Subject Alternative NameAdd alternative identity details such as **DNS**, **Email address**, **UPN**, **URI**, or **SID**. This field supports [Hexnode UEM wildcards](https://www.hexnode.com/mobile-device-management/help/how-to-pass-device-and-user-information-using-the-wildcards-supported-by-hexnode-mdm/).Upload certificate to extract fingerprintUpload the CA certificate to extract the fingerprint and verify that the device connects to the intended SCEP server.Configure Generic SCEP Settings for iOS Devices ----------------------------------------------- Use the following settings when the iOS SCEP policy in Hexnode UEM integrates with a third-party SCEP-enabled Certificate Authority. Generic SCEP configuration settings for iOS devicesConfigurationDescriptionServer URLThe SCEP service URL used to request and receive client certificates.SubjectEnter the X.500 name used to identify the certificate entity, such as **C=Country** or **O=Organization**. This field supports [Hexnode UEM wildcards](https://www.hexnode.com/mobile-device-management/help/how-to-pass-device-and-user-information-using-the-wildcards-supported-by-hexnode-mdm/).ChallengeEnter the SCEP challenge password used to authenticate the certificate request.Key sizeSelect **1024** or **2048** bits. The default key size is **1024**.Key typeSelect the key encryption type. The currently supported key type is **RSA**.Key used forSpecify whether the key is used for **Signing**, **Encryption**, or both, if supported by the CA.Number of automatic retriesEnter the number of retry attempts when the server response is pending.Retry delay (in seconds)Enter the number of seconds between subsequent retry attempts.Subject Alternative NameAdd alternative identity details such as **DNS**, **Email address**, **UPN**, **URI**, or **SID**. This field supports [Hexnode UEM wildcards](https://www.hexnode.com/mobile-device-management/help/how-to-pass-device-and-user-information-using-the-wildcards-supported-by-hexnode-mdm/).Upload certificate to extract fingerprintUpload the CA certificate to extract the fingerprint and verify that the device connects to the intended SCEP server.Associate and Deploy the iOS SCEP Policy in Hexnode UEM ------------------------------------------------------- After configuring the SCEP settings, assign the policy to the required Hexnode UEM targets. 1. Navigate to the **Policy Targets** tab. 2. Click **+Add Devices**. 3. Select the target **Devices**, **Users**, **Device Groups**, **User Groups**, or **Domains/OUs**. 4. Click **Save** to push the policy. Troubleshoot SCEP Certificate Deployment for iOS Devices -------------------------------------------------------- Use the following checks when a SCEP certificate does not install correctly on an iOS device managed by Hexnode UEM. ### Certificate request failed If the SCEP certificate request fails during deployment, verify that the configured Server URL is reachable from the device network. Also check whether the challenge password configured on the SCEP server has expired or no longer matches the value deployed in the Hexnode UEM policy. ### Identity mismatch in the certificate request If the issued certificate does not contain the expected identity, check that the Subject field uses a valid X.500 format. When Hexnode UEM wildcards are used in the Subject or Subject Alternative Name, verify that the corresponding user or device data is populated in the Hexnode UEM portal. ### Certificate request remains pending If the device remains in a pending state, review the **Number of automatic retries** and **Retry delay (in seconds)** values. These settings should give the CA enough time to process the pending certificate request. ### Fingerprint validation errors If a CA certificate fingerprint is provided, it must match the CA certificate exactly. When the fingerprint does not match, the device rejects the connection to the SCEP server.