---
title: "SCEP Profile"
slug: "scep-profile"
updated: 2025-07-22T17:44:15Z
published: 2025-07-22T17:44:15Z
canonical: "support.kandji.io/scep-profile"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# SCEP Profile

Kandji's SCEP Profile feature allows you to distribute and re-distribute certificates to Apple devices automatically.

> [!WARNING]
> Only static challenges are supported when using the SCEP Library Item.

### Create a SCEP Profile Library Item

Log in to your Kandji tenant before performing the next steps.

To add this Library Item to your Kandji Library, follow the steps outlined in the [Library Overview](/kb/library-overview) article.

1. Give your SCEP Library Item a name.
2. Select the desired [Blueprints](/v1/docs/getting-started-with-assignment-maps).

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1056AM@2x.png)
3. Input the base URL for your SCEP server.
4. Optionally, put in a display **Name**, **Challenge**, and **Fingerprint**.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1058AM@2x.png)
5. Configure the **Subject** (optional), and **Subject Alternative Name Type.**
6. Configure the **Key Size** and **Key Usage**

**![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1100AM@2x(1).png)**
7. Optionally, configure retry, access, export, expiration, and redistribution settings.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1101AM@2x.png)

### Other Considerations

#### Profile Redistribution

When the **Automatic profile redistribution** option is selected, Kandji will check the expiration date of the issued certificate and attempt to re-install the profile automatically to renew the certificate. When using this option, the $PROFILE_UUID will be appended to the Subject in the request.

#### Preventing Key Extraction

Using the **Prevent the private key data from being extracted in the keychain** option can prevent users from extracting the private key for the issued certificate.