Google Is Retiring Legacy SCEP for Chromebooks. What Does It Mean for Your Wi-Fi Certificates?

Aaron Crawfis | November 6, 2026

Google Is Deprecating Legacy SCEP Profiles for ChromeOS

If your Chromebooks connect to WPA Enterprise Wi-Fi using certificates and EAP-TLS through legacy SCEP profiles, there’s a date you need on your calendar: June 30, 2027. Google just announced that legacy SCEP profiles for ChromeOS are being retired, and devices using those profiles need to move to the new Certificate Provisioning API before then.

The good news is that if you followed our current guide for issuing Keytos Shield certificates to Chromebooks, you’re already using the Certificate Provisioning API. But if you’re still using legacy Secure SCEP profiles, you’ll need to migrate before the June 30, 2027 deadline, regardless of whether your SCEP backend is NDES, Shield, or another CA.

Let’s take a look at what Google is changing, what you need to do about it, and where Keytos Shield fits.

What Changes for Chromebook SCEP Certificates on June 30, 2027?

On June 30, 2027, Google will turn off the server-side components that legacy SCEP profiles depend on, so old setups that depend on it will stop working. Here’s what that means for you:

• No new certificates. If you don’t migrate, you won’t be able to issue any new certificates. Existing certificates keep working until they expire, and then those Chromebooks drop off your Wi-Fi.
• Version pinning won’t save you. The change happens on Google’s side, so keeping your Chromebooks on an older ChromeOS release doesn’t keep the legacy flow alive.
• The Secure SCEP card goes away. Once you migrate, your Chromebooks get client certificates through the Certificate Provisioning API only. The Secure SCEP card in the Google Admin console is the legacy path.

If you issue certificates to classrooms full of Chromebooks using legacy SCEP profiles, you’ll need to plan the migration carefully. The renewal cliff can affect many devices at once, potentially leaving entire classrooms without Wi-Fi access if you miss the June 30, 2027 deadline.

What Is the ChromeOS Certificate Provisioning API?

Under both models, the Chromebook generates its own key pair, and the Google Cloud Certificate Connector, a Windows service you run, sends the request to your SCEP certificate authority. What changes is how Google gets requests to your connector and how you set it up.

With the Certificate Provisioning API, Google publishes each Chromebook’s certificate request to a Pub/Sub topic in a Google Cloud project you own. The connector reads from that subscription, gets the certificate from your CA, and returns it to Google through the Chrome Management API. In Google Admin, the old single SCEP profile is now two objects: a domain-wide Certificate Authority connection and per-OU certificate provisioning profiles. Your Wi-Fi network then points to the certificate profile.

A few details from Google’s migration guide are worth knowing before you start:

• You need a billing account. Pub/Sub requires one, but Google expects more than 98% of customers to stay inside the free tier and pay nothing.
• Two placeholders are gone. ${DEVICE_ASSET_ID} and ${DEVICE_ANNOTATED_LOCATION} aren’t supported in certificate provisioning profiles, so update any subject or SAN that uses them.
• Renewal is limited to 1-90 days before expiration. For a one-year certificate, Google suggests 30 days. That setting controls when the Chromebook renews, not how long the certificate is valid. Validity comes from your CA.
• Attestation maps over. Strict attestation on the legacy profile becomes Remote attestation, and Relaxed becomes None.

Does Keytos Shield Still Support SCEP Certificates for Chromebooks?

Yes. Keytos Shield issues SCEP certificates to Chromebooks managed in Google Workspace, and it does it through the new Certificate Provisioning API. There’s nothing to migrate if you followed our guide.

The Keytos Shield Chromebook guide walks you through the whole Certificate Provisioning API setup: the Google Cloud project and Pub/Sub topic, the connector’s adapter_config.json, a SCEP Certificate Authority connection, and a certificate provisioning profile. GCCC sends each request to your Shield static SCEP endpoint, Shield issues the certificate, and the Chromebook joins your Wi-Fi with EAP-TLS against Shield’s cloud RADIUS. You can issue user certificates, device certificates for shared and classroom Chromebooks that need Wi-Fi on the sign-in screen, or both.

Your Chromebooks also don’t need to exist in Entra ID. A Shield access policy without Entra ID matching accepts any valid, unrevoked certificate from your Shield CAs, and you cut off a lost Chromebook by revoking its certificate. Shield includes the cloud PKI and the cloud RADIUS in one subscription, so there’s no NDES server to keep alive and no NPS box to patch. If you’re wondering how Shield compares to running EZCA and EZRADIUS separately, we break that down here.

How to Migrate Chromebooks Off Legacy SCEP Without Losing Wi-Fi

If you still have a legacy Secure SCEP profile, whether it points at NDES, Shield, or another CA, Google recommends a staged rollout where both setups run side by side:

1. Create the Certificate Authority connection in your root OU.
2. Create a new certificate provisioning profile for a small test OU, copying the subject, SANs, key usage, and renewal values from your legacy profile.
3. Add a legacy_configuration block to adapter_config.json, so the same connector keeps serving legacy requests while it serves new ones. Keep your old config.json in place for rollback.
4. Confirm a test Chromebook receives a certificate through the new profile.
5. Roll the certificate provisioning profile out to larger OUs while leaving their existing EAP-TLS Wi-Fi configuration in place.
6. Confirm that devices in each OU have installed the new certificates before pointing that OU’s EAP-TLS Wi-Fi network at the new certificate profile; provide a tested fallback connection for any devices still awaiting certificates.
7. Delete the legacy SCEP profile only after every device that still needs access has successfully connected using the new certificate profile or has a verified fallback connection.

Be careful with this last step. Deleting a legacy SCEP profile removes the certificates it issued from every Chromebook that used it. If you delete it before the new certificates land, those devices lose Wi-Fi immediately. Watch the certificate counts in your CA (in Shield, the Certificate logs page) before you completely switch over.

Watch Out for Google Cloud Organization Policies

New Google Cloud organizations enforce “Secure by Default” organization policies. Disable service account key creation blocks the JSON key the connector signs in with, and Domain restricted sharing blocks Google’s cert-provisioning-api-pubsub-publisher@system.gserviceaccount.com service account from publishing to your topic. We recommend overriding both only on the project you use for the connector so the rest of your organization stays protected. Our guide walks you through the necessary steps to configure these policies correctly.

Is This a Good Time to Retire NDES for Chromebooks?

If your legacy profile points at NDES and AD CS, you’re about to rebuild the connector configuration anyway. That’s the cheapest moment you’ll get to move the CA too. Swapping the ca_endpoint_url from NDES to a cloud SCEP endpoint removes the IIS server, the RA certificates, and the on-premises CA from your Chromebook story. It’s the same reasoning behind moving your Windows CA to the cloud, just with a deadline attached.

Conclusion - Why You Should Migrate to the Certificate Provisioning API

On June 30, 2027, every Chromebook that uses certificates for Wi-Fi has to get them through the Certificate Provisioning API. The new model takes more setup on the Google Cloud side, but it adds dynamic SCEP challenges and ECC keys, and it’s the only path forward. Keytos Shield already supports it, so you can set up certificate-based Chromebook Wi-Fi today without planning a second migration. If you’re running school or district Wi-Fi, our student Wi-Fi case study shows what that looks like at scale.

If you want help planning your Chromebook migration or moving off NDES, schedule a FREE call with one of our identity experts, or start a free Keytos Shield trial and have your first Chromebook on certificate-based Wi-Fi this afternoon.