What is SCEP, and how does it work?

SCEP is how a device gets its own certificate automatically. The private key is created on the device and never leaves it. It's what makes issuing a certificate to every laptop a setting instead of a week of work.

How it works. The MDM tells the device to get a certificate and gives it a URL and a challenge password. The device creates its own private key and builds a request with only the public half. It encrypts the request to Passbeam's registration certificate and sends it to the URL. Passbeam checks the challenge, checks the device is allowed the identity it's asking for, signs it with that client's authority and sends the certificate back.

Because the private key never leaves the device, there's no file or email that could leak it. And renewal is the same exchange again, so a certificate near expiry is replaced without anybody noticing.

One thing to know: Apple devices cache the enrolment URL. If a client's enrolment address changes, iPhones and Macs keep using the old one until the profile is pushed again, whichever MDM pushed it. Windows reads it again each time.