![\"Obtaining](\"http:\/\/live-42gears-site.pantheonsite.io\/wp-content\/uploads\/2018\/08\/Obtaining-Authentication-Certificates-Using-SCEP-banner.png\")
<\/p>\n<\/p>\n
Extensive use of mobile devices in enterprises raise security concerns such as accessing work emails \u00a0with unauthorized devices, password theft, accessing of corporate resources from untrusted devices etc. Although password-based authentication may secure corporate devices and networks, it has two key disadvantages:<\/span><\/p>\n Using digital certificates for enterprise devices ensures <\/span>authentic use of devices and corporate networks<\/b>, securing them from external threats. Companies can setup security policies in a manner \u00a0that, apart from username\/password, devices need to have valid certificates installed before they are granted access to enterprise resources such as emails and Wi-Fi network. <\/span><\/p>\n Certificates can now be included in an MDM profile in multiple ways for different purposes such as allowing users access to work email or corporate network from only assigned devices. <\/span><\/p>\n But these certificates can be leaked or stolen. In order to safeguard against such situations, enterprises must use different certificates for each \u00a0devices. If a device certificate is stolen, the admin can block or cancel that certificate and issue a new one for that particular device. This will be a better and more secure \u00a0option than having a single certificate for all enterprise devices.<\/span><\/p>\n <\/p>\n CBA ensures simplicity to authenticate enterprise users without their ID and password. Also, certificate management tasks such as issuing, renewing, and revoking can be systematically arranged by CA (Certificate Authority). However, implementing CBA in large scale devices is a big challenge where deployment of certificates and manually enrollment process are complete.<\/span><\/p>\n The Simple Certificate Enrollment Protocol (SCEP) simplifies the certificate enrollment \u00a0process for a large number of devices. Using SCEP, it\u2019s easy to deploy unique certificates on multiple devices without manual intervention.<\/span><\/p>\n <\/p>\n SCEP<\/strong> is a protocol designed to provide digital certificates electronically and easily to the network users. It was developed by VeriSign, Inc. for Cisco Systems, Inc., to facilitate network admin to enroll devices for certificates on large scale.<\/span><\/p>\n To enroll SCEP with MDM systems, SCEP profiles have to be created and remotely delivered to devices. Once the SCEP profiles are applied, CA (Certificate Authority) issued certificates will get generated and deployed to devices, enabling them to connect to multiple access points such as work mail server, work Wi-Fi network or VPN.<\/span><\/p>\n \u00a0 <\/p>\n\n
Certification-Based Authentication (CBA)<\/b><\/h3>\n
SCEP Background<\/b><\/h3>\n
![\"Obtaining](\"http:\/\/live-42gears-site.pantheonsite.io\/wp-content\/uploads\/2018\/08\/Obtaining-Authentication-Certificates-Using-SCEP-Illustration.png\")
<\/span><\/p>\nAdvantages of using SCEP<\/b><\/h3>\n