Breadcrumbs

Device enrollment (EST and SCEP)

Network devices, phones and other equipment can enroll for certificates from a Monopam private CA by themselves, over EST (RFC 7030) or SCEP (RFC 8894).

Applies to

Who can do this

Monopam v2026.10

Administrators with permission to manage certificate enrollment.
Device Enrollment profiles with issuing CA and EST endpoint

Figure 1. Certificates → Enrollment. Endpoint addresses are blurred.

  1. Click New Profile (3). Choose the Issuing CA (1), the certificate lifetime and the credentials devices use.

  2. Copy the endpoint (2) into the device: cacerts gives the CA chain, and devices post their CSR to simpleenroll with Basic authentication. These addresses are for devices, not pages you open.

  3. Issued certificates appear in the inventory like any other.

  • Certificate issuers

  • Certificate inventory