What is SCEP, and how does it work?

SCEP is the protocol that lets a device get its own certificate without a human being involved, and without the private key ever leaving the device. It is what turns "issue a certificate to every laptop" from a week of work into a checkbox.

The short version of what happens: the MDM tells the device to get a certificate, and hands it a URL and a challenge password. The device generates its own private key, right there, and never sends it anywhere. It builds a request containing only the public half, encrypts that request to Passbeam's registration certificate, and posts it to the URL. Passbeam checks the challenge, checks the request is asking for an identity it is entitled to, signs it with that client's authority, and sends the certificate back.

Two things follow from that, and both matter. The private key is generated on the device and stays there, so there is no moment at which a stolen backup or an intercepted email contains anything usable. And because the whole exchange is machine-to-machine, renewal is the same exchange again — a certificate approaching expiry is replaced without anybody noticing.

What people trip over is that Apple devices cache the enrolment URL. If a client's enrolment address ever changes, an iPhone or a Mac carries on using the old one until the profile is re-pushed, whichever MDM pushed it. Windows re-reads it. That asymmetry has cost us a morning, so it is worth knowing before it costs you one.