In attempts to setup our first instance of NDES/SCEP in the wild on Cisco routers we have run into a concern.

Currently our organization has a three tier PKI. We have an AD CS server on the third tier running NDES. All aspects of the system are functioning, but through discussion and testing we have a concern.

How do Root and Intermediary CA certificates get updated on the end device?

If we have a router configured and functioning with a trusted CA/RA using SCEP, but the issuing CA certificate is nearing expiration will the SCEP service execute the GetCACert command again to refresh the local cache of the issuing certificate?

SCEP RFC (draft-nourse-scep-23)

1 Answer 1


Thomas Pornin provided an acceptable answer for a similar question at:

Renewing Microsoft Certificate Services Root Certificate

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .