Certificate enrollment servers built to the actual RFCs.
SCEP and EST certificate enrollment is deep PKI territory, and most software teams have never been near it. We build standards-compliant SCEP (RFC 8894) and EST (RFC 7030) servers that sit in front of your certificate authority and provision X.509 certificates to devices, MDM fleets, VPN clients, and IoT at scale. CA integration, HSM-backed keys, automated renewal, and revocation, done properly.
PKI is unforgiving, and generalist developers get it wrong in ways you only find later.
- Enrollment cobbled together with scripts that ignore the RFCs, so third-party clients and MDM profiles refuse to talk to it.
- Private keys handled carelessly in software when they should never leave an HSM boundary.
- No renewal or revocation story, so certificates silently expire and take production down with them.
- A certificate authority nobody fully understands, with issuance policy that cannot be safely changed.
- Compliance requirements (FIPS, audited PKI) treated as an afterthought instead of a design constraint.
A certificate enrollment layer that speaks the standards and runs the full lifecycle.
- SCEP built to RFC 8894 and EST built to RFC 7030, using standard PKCS#7, PKCS#10, and X.509 so any compliant client interoperates.
- A registration authority in front of your existing CA (Microsoft AD CS, EJBCA, OpenSSL-based, or managed PKI), not a replacement for it.
- HSM integration over PKCS#11 so keys stay in hardware, with FIPS-aware design where you need it.
- Automated renewal, re-enrollment, and revocation with OCSP and CRL, so the lifecycle runs without manual intervention.
- Full ownership of source, build tooling, and documentation. No proprietary black box between you and your own PKI.
What an SCEP or EST server engagement covers
Protocol Implementation
SCEP (RFC 8894) or EST (RFC 7030), or both, with correct handling of CSRs, challenge validation, CA cert distribution, and re-enrollment.
Certificate Authority Integration
A registration authority layer wired to your existing CA: AD CS, EJBCA, OpenSSL-based, or a managed PKI provider.
HSM and Key Protection
PKCS#11 integration so private keys never leave the hardware, with key usage policy and RA/CA role separation.
Device and MDM Enrollment
Enrollment flows for MDM profiles, 802.1X and EAP-TLS, VPN clients, and IoT fleets, designed for scale and zero-touch provisioning.
Lifecycle: Renewal and Revocation
Automated renewal before expiry, re-enrollment, and revocation with OCSP responders and CRL distribution points.
Deployment and Documentation
Production deployment, operational runbooks, and full documentation so your team can run the PKI with confidence.
How we run a PKI enrollment project
Discovery and Threat Model
We map your CA, devices, compliance requirements, and trust boundaries before writing a line, because in PKI the design decisions are the hard part.
Prototype Against Your CA
A working enrollment against your actual CA and a real client, proving interoperability before we build the full server.
Build and Harden
Full protocol implementation, HSM integration, renewal and revocation, and clean failure handling for fleet-scale enrollment.
Deploy and Handover
Production rollout, operational runbooks, documentation, and a support window so the lifecycle runs itself afterward.
The PKI stack we build on
Certificate infrastructure rewards standards discipline and punishes improvisation. We stick to the proven tools.
OpenSSL and BouncyCastle
Battle-tested cryptography for CSR handling, PKCS#7 and PKCS#10 processing, and X.509 certificate construction.
EJBCA and Microsoft AD CS
We integrate with the certificate authorities you already run rather than asking you to replace your trust anchor.
HSM over PKCS#11
Hardware-protected keys for FIPS-aware environments, so private keys never exist in software memory.
.NET and Java
Robust, long-lived server implementations with the cryptographic library support that PKI work demands.
OCSP and CRL services
Real-time and cached certificate status so relying parties can trust what they are validating.
Linux and containerized deployment
Reproducible, auditable deployments for infrastructure that has to be trusted and maintained for years.
Related standards and protocols we work with
SCEP and EST questions we get asked
Related services you might need
Custom Software Development
The parent practice: domain-specific tooling, background services, and legacy modernization across many stacks.
Learn moreWindows Service Development
Long-running services for certificate renewal jobs, OCSP responders, and unattended PKI automation.
Learn moreDevOps and Cloud
Hardened, auditable deployments for infrastructure that has to be trusted and maintained for years.
Learn moreNeed certificate enrollment done to the standards, not improvised?
Tell us about your CA, your devices, and your compliance requirements. We will tell you honestly what SCEP, EST, or both looks like for your environment. Fourteen years of shipping the software other firms turn down, including the PKI work most of them cannot.