In attempts to setup our first instance of NDES/SCEP in the wild on Cisco routers we have run into a concern.
Currently our organization has a three tier PKI. We have an AD CS server on the third tier running NDES. All aspects of the system are functioning, but through discussion and testing we have a concern.
How do Root and Intermediary CA certificates get updated on the end device?
If we have a router configured and functioning with a trusted CA/RA using SCEP, but the issuing CA certificate is nearing expiration will the SCEP service execute the GetCACert command again to refresh the local cache of the issuing certificate?