In the world of network security and certificate management, two prominent technologies often come to the forefront: Microsoft Network Device Enrollment Service (NDES) and Simple Certificate Enrollment Protocol (SCEP). Although these technologies are interconnected, they serve distinct roles within the digital landscape. Let’s take a deeper dive into what each technology is and how they work hand-in-hand.
SCEP stands as a critical protocol utilized for requesting and managing digital certificates in network environments. Its versatility allows it to be compatible with various PKI solutions, making it a widely-adopted standard for certificate management. At its core, SCEP simplifies the process of digital certificate issuance and management, ensuring that networked systems are authenticated and secure.
For a more in-depth look at what SCEP is, check out our blog on what is SCEP and how SCEP works, or watch the video below hosted by the lovely Sir Tificate!
NDES and SCEP are a match made in cybersecurity heaven! SCEP lays the groundwork for certificate enrollment and management, while NDES extends this framework within a Microsoft-centric environment, optimizing the process for a variety of network devices. This synergy enables a more streamlined and efficient approach for devices to acquire, renew, and manage digital certificates.
In other words, while SCEP is the protocol governing the issuance and management of digital certificates, NDES acts as a component of ADCS, utilizing SCEP for efficient certificate distribution to network devices. The way in which SCEP and NDES work together is crucial for maintaining the security and integrity of networked systems and data, especially in complex and dynamic IT environments.
The important question now, then, is this: is NDES the best software to use to work with SCEP?
You might consider using NDES for connecting to Intune because ADCS can’t directly issue certificates; however, this Microsoft technology is actually rather archaic and hasn’t even seen any significant updates! Running NDES requires managing several servers, maintaining uptime, and handling credentials for MDM connectivity, among other tedious things. While NDES remains a viable option, there’s a more efficient, cloud-based alternative: EZCA.
Recommended by Intune as a SCEP server and a Certificate Authority, EZCA is a full cloud PKI that can replace your ADCS handles everything in the cloud, from certificate issuance to revocation. This eliminates the need for any on-premises infrastructure related to your certificate needs (unless you want to stay with on-premises, which EZCA can also work with).
Given EZCA’s ease of use compared to NDES, it is clear that your organization does not need to use NDES to work with SCEP. Why complicate your PKI management with an archaic, tedious software when EZCA offers a straightforward and secure cloud-based solution? See how easy it is to setup a SCEP CA in EZCA:
