> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the SCEP Library Item

> Set up the SCEP Library Item in Iru Endpoint to issue device certificates from a SCEP server. Configure certificate templates for Apple and Windows devices.

<Callout icon="list-check" color="#B84A7A" iconType="regular">This Library Item is available for Apple and Windows devices</Callout>
The **Simple Certificate Enrollment Protocol (SCEP)** profile lets you securely issue certificates to your devices from a SCEP server and Certificate Authority (CA). You can use these certificates for services like 802.1x, VPN, and authentication.
Iru's SCEP Profile feature automatically distributes and re-distributes certificates to **Apple** and **Windows** devices. Certificates are delivered at the machine level, not per user.

<Note>
  You can only use static challenges with the SCEP Library Item.
</Note>

## Create a SCEP Profile Library Item

Log in to your Iru tenant before you start.
To add this Library Item to your Iru Endpoint Library, follow the steps in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.

<Steps>
  <Step title="Navigate to Library">
    Navigate to the **Library** and select **Add Library Item**.
  </Step>

  <Step title="Select SCEP">
    Search for and select **SCEP**.
  </Step>

  <Step title="Name the Library Item">
    Give your SCEP Library Item a descriptive name.
  </Step>

  <Step title="Select Platforms">
    Choose which platforms should get the profile under **Install on**.
  </Step>

  <Step title="Select Blueprints">
    Pick the [Blueprints](/en/endpoint/getting-started/blueprints-and-library/configuring-blueprints) you want to use.
  </Step>

  <Step title="Input SCEP Server URL">
    Enter the base URL for your SCEP server.
  </Step>

  <Step title="Configure Display Settings">
    Optionally, add a display **Name**, **Challenge**, and **Fingerprint**.
  </Step>

  <Step title="Configure Subject Settings">
    Set the **Subject** (optional) and **Subject Alternative Name Type**.
  </Step>

  <Step title="Configure Key Settings">
    Set your **Key Size** and **Key Usage**.
  </Step>

  <Step title="Configure Additional Settings">
    Optionally, add retry, access, export, expiration, and redistribution settings.
  </Step>
</Steps>

## General Settings

* **URL**
  The base URL for your SCEP server (like `scep.example.org`).
* **Name** (optional)
  A label to distinguish this CA when you use multiple certificates.
* **Challenge**
  A pre-shared secret string for automatic enrollment.
* **Fingerprint**
  The certificate authority fingerprint as a hex string.

### Subject Configuration

* **Subject**
  Distinguished name in X.500 format. You can use [global variables](/en/endpoint/library/library-items-profiles/global-variables) like:
  * `CN=$SERIAL_NUMBER`
* **Subject Alternative Names (SAN)**
  Add alternative identifiers, including [global variables](/en/endpoint/library/library-items-profiles/global-variables), like:
  * `RFC 822 Name` = `$DEVICE_NAME`

## Key Settings

* **Key size**
  Pick your key size (1024, 2048, or 4096 bits).
* **Key usage**
  Options:
  * Signing
  * Encryption
  * Both signing and encryption

## Additional Options

* **Retries**
  How many times to retry if the server sends a *PENDING* response.
* **Automatic profile redistribution**
  When enabled, Iru checks certificate expiration dates and automatically re-issues new certificates when they're about to expire.

<Note>
  Renewal only starts when the certificate is within the redistribution window, which must be at least 5 days before expiration. This prevents certificates from being renewed too early, like right after they're issued.
</Note>

* When renewing, Iru appends the `$PROFILE_UUID` variable to the Subject.

## Platform-Specific Options

<Tabs>
  <Tab title="Apple">
    ### Apple-Specific Options

    * **Retry delay**
      How long to wait (in seconds) between retries.
    * **Allow all apps to access the private key**
      Gives all apps access to the private key in the keychain.
    * **Prevent private key extraction**
      Prevents exporting the private key from the keychain (macOS 10.15+). You should enable this for better security.
    * **Certificate expiration notification**
      Sends notifications when certificates are about to expire on macOS.

    <Note>
      When **Automatic profile redistribution** is enabled for Apple devices, specify a user global variable in the Subject Alternative Names (SAN) if user information is required in the certificate. This is necessary because the Wi-Fi Library Item ID is added to the Common Name in the certificate's subject to track certificate renewal.
    </Note>
  </Tab>

  <Tab title="Windows">
    ### Windows-Specific Options

    * **Hash algorithm**
      Pick the algorithm (like SHA-256).
    * **Retry wait time in minutes**
      How long to wait between retries on *PENDING* responses.

    <Note>
      Maximum retries on Windows is 30.
    </Note>

    * **Extended key usage**
      Add extra usages like *Client authentication*.
    * **Key protection**
      Choose where to store the private key. You should enable **Prevent the private key data from being extracted** for better security.
    * **Valid period**
      Set how long certificates stay valid.

    <Note>
      The validity period needs at least a 5-day renewal window. For example, if your certificate is valid for 10 days, you can set automatic redistribution to start 5 days before expiration. You can't set a shorter window (like 7 days on a 10-day certificate) because that would try to renew too soon after issuing.
    </Note>
  </Tab>
</Tabs>

## Important Considerations

### Profile Redistribution

Automatic profile redistribution renews certificates before they expire, so you avoid downtime and keep authentication working smoothly.

### Preventing Key Extraction

Enabling **Prevent the private key data from being extracted** prevents end users from exporting the private key. You should enable this for better security.

## Best Practices

<Steps>
  <Step title="Plan certificate lifecycle">
    Set certificate validity periods and renewal windows to keep services running without interruption.
  </Step>

  <Step title="Secure challenge secrets">
    Use strong, unique challenge secrets for each SCEP configuration to prevent unauthorized enrollment.
  </Step>

  <Step title="Monitor certificate status">
    Check certificate enrollment and renewal status regularly so you can catch and fix issues quickly.
  </Step>

  <Step title="Test configurations">
    Test SCEP configurations on a few devices first - this helps you catch issues before they affect your whole fleet.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Certificate enrollment failing">
    **Possible causes:**

    * Incorrect SCEP server URL
    * Invalid challenge secret
    * Network connectivity issues
    * Certificate authority fingerprint mismatch
      **Solutions:**
    * Verify SCEP server URL and accessibility
    * Confirm challenge secret matches server configuration
    * Check network connectivity and firewall rules
    * Validate certificate authority fingerprint
  </Accordion>

  <Accordion title="Certificate renewal issues">
    **Possible causes:**

    * Renewal window too short
    * SCEP server not responding
    * Certificate validity period conflicts
      **Solutions:**
    * Ensure renewal window is at least 5 days before expiration
    * Check SCEP server availability and logs
    * Verify certificate validity period configuration
  </Accordion>

  <Accordion title="Private key access problems">
    **Possible causes:**

    * Key protection settings too restrictive
    * Keychain access permissions
    * Application-specific key access requirements
      **Solutions:**
    * Review key protection and access settings
    * Check keychain permissions for applications
    * Configure appropriate key access for required applications
  </Accordion>
</AccordionGroup>

## Security Considerations

<CardGroup cols={2}>
  <Card title="Challenge Security" icon="shield">
    You should use strong, unique challenge secrets and rotate them regularly to prevent unauthorized enrollment.
  </Card>

  <Card title="Key Protection" icon="lock">
    Enable private key extraction prevention to keep your certificates secure.
  </Card>

  <Card title="Certificate Monitoring" icon="eye">
    Monitor certificate enrollment and renewal activities to spot security issues.
  </Card>

  <Card title="Access Control" icon="user">
    Set key access permissions based on what your applications need.
  </Card>
</CardGroup>