SCEP / Intune certificate expired

Laptops show “Company Portal cannot install the profile” with SCEP errors—intune scep certificate expired spans the TLS cert on your NDES/SCEP URL, the RA certificate, and the client cert template lifetime Intune requested, not the BitLocker recovery key.

Intune PKCS certificate profiles drive devices to a SCEP endpoint (often Microsoft NDES on-premises or a third-party CA integration). The HTTPS URL in the profile must present valid TLS. The SCEP RA certificate signing responses must also be within validity. User certs issued via template carry their own notAfter—confusing those layers creates false “SCEP broken” diagnoses.

Azure AD joined devices pulling Wi‑Fi or VPN certs stop renewing silently when challenge passwords or the Intune Certificate Connector’s outbound trust breaks after an expired management cert.

First response

Identify profile type (SCEP, PKCS, AD CS), public URL devices call, and NDES server logs (wevtutil Application log for NDES). In Intune admin center, open Devices → Monitor → Device enrollment failures for affected platform.

# On NDES / SCEP server – export IIS site binding cert dates
Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -match 'NDES|SCEP' } | Select Subject, NotAfter, Thumbprint


echo | openssl s_client -connect scep.contoso.com:443 -servername scep.contoso.com 2>/dev/null | openssl x509 -noout -dates -subject

Capture Intune profile ID and whether connector version is current.

What this error means

MDM agents POST CSR payloads to SCEP over HTTPS. Expired web server certificate on https://scep... fails before the CA can issue. Separately, devices already holding user certs hit authentication failures when those certs expire—users need a new profile deployment, not just TLS fix.

The Intune Certificate Connector signs CSR traffic to your CA; its service account cert or TLS outbound trust to CA web enrollment can expire independently of the SCEP IIS site.

Challenge password lifetime in NDES registry is not X.509 expiry but causes similar enrollment failures if operators confuse timer with cert dates.

Layered PKI means helpdesk scripts that only renew IIS bindings leave RA certificate past notAfter—SCEP handshake succeeds at TLS layer while CA rejects enrollment with opaque SCEP error codes in Company Portal.

Wi‑Fi profiles using EAP-TLS stop associating when device cert expires even after SCEP web server TLS is perfect; users perceive “Wi‑Fi broken after Intune fix” until profiles redeploy client certs.

BYOD and COPE fleets on different enrollment profiles may show partial success—one dynamic group received updated SCEP URL while pilots on legacy profile still target decommissioned host with expired Let's Encrypt cert.

Common causes

NDES IIS binding still serves last year's scep.contoso.com cert while AD CS renewed CA hierarchy. Intune profile static challenge URL points at decommissioned host with expired Let's Encrypt.

Certificate Connector updated in portal but on-prem service still uses expired client auth cert to reach CA. Template allows 1-year user cert; helpdesk never renewed Intune SCEP certificate profile targeting the same template before mass Wi‑Fi cert expiry.

Hybrid join devices on stale VPN cannot reach internal SCEP URL—looks like SCEP down when the issue is expired VPN server cert on another guide path.

WAF or Application Gateway SSL termination in front of NDES presents expired edge cert while IIS behind holds renewed material—mobile devices on Internet path fail while campus users on split tunnel reach healthy internal binding.

NDES service account password expiry blocking RA cert renewal is often misclassified as SCEP TLS—check service start events and RA cert notAfter in the same incident bridge.

Third-party SCEP gateways that front AD CS with their own TLS listener need renewal on both gateway and NDES when architectures stack vendors.

Confirm from the outside

SCEP HTTPS endpoint

curl -vI https://scep.contoso.com/certsrv/mscep/mscep.dll 2>&1 | grep -Ei 'expire|SSL certificate|401|403'

OpenSSL

echo | openssl s_client -connect scep.contoso.com:443 -servername scep.contoso.com 2>/dev/null | openssl x509 -noout -dates -issuer -subject

Device-side (sample PEM from remediated device)

openssl x509 -in device_wifi.cer -noout -dates -subject

How to read the output

Distinguish listener notAfter from issued client cert notAfter. Listener fix requires IIS/proxy renewal; client cert fix requires Intune profile redeploy and possibly user remove/reinstall profile.

Enrollment failure blades in Intune admin center often include HTTP status—correlate 403 or connection reset with openssl listener dates before deep-diving CA templates.

Test SCEP from Android and iOS pilot devices on cellular without VPN to mimic real user path; VPN-only successful tests hide Internet-facing expired listener.

Fix checklist

1. Renew TLS on SCEP/NDES public URL; reload IIS; update any WAF cert attachments.
2. Renew NDES RA certificate per Microsoft NDES guidance; update registry thumbprint bindings.
3. Rotate Intune Certificate Connector if its auth cert expired; sync connector health in portal.
4. Update SCEP profile URLs, challenge type, and validity period in Intune; assign to affected groups.
5. For Wi‑Fi/VPN: remove old device cert profile, deploy new, validate EAP-TLS on test device.
6. Regenerate NDES challenge password if password cache expired (notAfter unrelated but common combo failure).
7. Monitor CA issuance logs (certsrv.msc) for successful SCEP requests after fix.
8. Document PKI hierarchy next renewal dates in security CMDB.

Pilot profile assignment to a single device group before org-wide push—mass redeploy during wrong template validity windows can flood CA with denied requests.

After RA renewal, restart NDES application pool and verify mscep.dll responds without IIS worker holding stale SSL bindings in memory.

Communicate to campus network team when EAP-TLS Wi‑Fi profiles change—users may need to forget and rejoin SSID after new client cert deploys.

Record connector version and server OS build in change ticket; future auditors trace SCEP incidents faster with connector lineage documented.

When to use automation

intune scep certificate expired rarely surfaces on public marketing domains—monitor the SCEP/NDES FQDN devices reach, including split-tunnel VPN paths testers use.

External /check on the SCEP URL when it is Internet-published. Internal-only SCEP needs synthetic enrollment tests plus file-based tracking of CA and RA NotAfter. Link identity playbooks: AD FS certificate expired, RADIUS EAP-TLS.