How-To: Issue SCEP Certificates with Keytos Shield Cloud PKI

Learn how to issue SCEP certificates to your managed devices with Keytos Shield, a cloud PKI with hosted SCEP for Intune, NinjaOne, and SimpleMDM and passwordless Wi-Fi.

Overview - How to Issue SCEP Certificates with Keytos Shield

The Simple Certificate Enrollment Protocol (SCEP) is the most widely supported way for a mobile device management (MDM) platform to request a unique certificate for each device or user. Keytos Shield hosts the SCEP service for you, so you can issue certificates for passwordless Wi-Fi and network authentication without running a SCEP server. This guide shows you how to find your Shield SCEP URL, give it to your MDM, and confirm that certificates are being issued.

Which SCEP Options Does Keytos Shield Offer?

Keytos Shield gives you a different SCEP URL depending on your MDM. Shield shows the details for each MDM you enable.

SCEP option Works with What you copy from Keytos Shield
Intune SCEP Microsoft Intune Intune SCEP URL. Shield validates the SCEP challenge that Intune generates for each device, so there is no password to share.
Static SCEP MDM platforms with a SCEP profile, such as NinjaOne and SimpleMDM Static SCEP URL and Static SCEP password. Treat the password like any other secret.

Prerequisites for Issuing SCEP Certificates with Keytos Shield

Before you begin, make sure you have completed these prerequisites:

  1. The Keytos Entra ID applications are registered in your tenant.
  2. You have signed up for a Keytos Shield Plan.
  3. You are a Subscription Owner or Network Administrator.
  4. You have completed the Keytos Shield Network Security onboarding.
  5. You have administrator access to your MDM, with permission to create SCEP profiles.

Step-by-Step Guide - How to Issue SCEP Certificates with Keytos Shield

Step 1 - How to Enable Your MDM in Keytos Shield

Keytos Shield only shows enrollment details for the MDM platforms you tell it about. Saving your selection also updates your certificate authority to support the enrollment protocols your MDMs need.

  1. Login to your Keytos Shield portal.

  2. From the left-hand menu, select Network profiles.

  3. From the top tabs, select Settings.

  4. Expand Mobile Device Management.

    Accessing MDM Settings in Keytos Shield

  5. Select the MDM solution(s) you use within your environment, including Intune, NinjaOne, or SimpleMDM. You can select as many as applicable.

    • Some MDM solutions may require additional configuration steps. Follow the specific instructions provided for each MDM solution to complete the integration.

  6. Click Save MDM Configuration to apply your changes and enable the integration with the selected MDM solution(s). Save MDM Configuration in Keytos Shield

Step 2 - How to Get Your Keytos Shield SCEP URL

Follow the section that matches your MDM. If you use more than one MDM, repeat the section for each one.

How to Get Your Intune SCEP URL (Intune SCEP)

  1. Open the Keytos Shield portal.

  2. From the left-hand menu, navigate to Network profiles.

  3. In the top tab bar, select Settings.

    Keytos Shield Network Profile Settings

  4. Under Mobile Device Management, make sure Intune is enabled.

    Enable Intune SCEP in Keytos Shield

  5. Under Certificate Authority and Enrollment, copy the Intune SCEP URL for your issuing CA. You’ll need this in a little bit.

    Get the Intune CA SCEP URL from Keytos Shield

How to Get Your Static SCEP URL and Password for NinjaOne, SimpleMDM, and Other MDMs

  1. Log in to your Keytos Shield portal.

  2. From the left-hand menu, navigate to Network profiles.

  3. At the top of the page, select the Settings tab.

    Keytos Shield Settings tab highlighted

  4. Expand Certificate Authority and Enrollment, and then expand your MDM, such as NinjaOne or SimpleMDM.

    Not seeing your MDM? Make sure to enable it under the Mobile Device Management section further up on the page and save your changes.

  5. Click the Copy button next to the Static SCEP URL.

    Keytos Shield Copy Static SCEP URL button highlighted

  6. Click the Copy button next to the Static SCEP password to copy the password without displaying it. You will need both values when you create the SCEP profile in your MDM.

Step 3 - How to Trust the Keytos Shield CA Certificates on Your Devices

For a device to trust the certificates Shield issues, and your Shield RADIUS servers, it must trust your Shield Root CA and Issuing CA certificates.

  1. In the same Certificate Authority and Enrollment section, expand your MDM.
  2. Next to rootca.cer, click Download.
  3. Next to issuingca.cer, click Download.
  4. Push both certificates to your devices as trusted certificates using your MDM. Our step-by-step guides show you how for each platform: distribute Shield network profiles.

Step 4 - How to Create the SCEP Profile in Your MDM

Now create a SCEP profile in your MDM that points your devices at Keytos Shield.

  1. In your MDM, create a new SCEP certificate profile.
  2. Paste the URL you copied in Step 2 into the SCEP server URL field.
  3. (Static SCEP only) Paste the Static SCEP password into the challenge or password field. Intune does not need a password.
  4. Set the Extended Key Usage to client authentication (1.3.6.1.5.5.7.3.2) so devices can use the certificate for Wi-Fi and network authentication.
  5. Assign the profile to the devices or users that should receive a certificate.

For a complete Intune walkthrough, including the exact profile settings, follow our Intune guide:

Distribute Network Profiles with Microsoft Intune

Step 5 - How to Verify Your SCEP Certificates Were Issued

After your devices check in with your MDM, confirm in Keytos Shield that certificates are being issued.

  1. In your Keytos Shield portal, expand Network security and click Certificates. Each certificate that Shield issued appears in the list with its Thumbprint, Issuance Date, and Expiry Date.
  2. Click Certificate logs, choose a date range, and click Get Logs. Requests that came in through SCEP show SCEP in the Cert Location Type column.

Your devices now have unique certificates and can authenticate to your network. To see every certificate and its history, read how to view certificate logs.

Frequently Asked Questions (FAQ) About SCEP Certificates in Keytos Shield

Does Keytos Shield Support Intune SCEP?

Yes. Keytos Shield integrates directly with Microsoft Intune via Intune SCEP to issue certificates for your managed devices and users.

Does Keytos Shield Support Static SCEP for Other MDM Platforms?

Yes. Keytos Shield supports static SCEP for MDM platforms such as Jamf Pro, Jamf Now, NinjaOne, Iru, and SimpleMDM. If your MDM supports ACME device attestation, such as Jamf Pro, ACME is an alternative to static SCEP.

How Do I Revoke a SCEP Certificate?

Open the Certificates page in your Shield portal and click Revoke next to the certificate. See how to revoke certificates for the full steps.

Next Steps - How to Connect Your Devices to Your Network

Now that your devices have SCEP certificates, you can push a Wi-Fi profile that uses them to authenticate to your network.

🚀 Distribute Network Profiles to Your Devices View Certificate Logs