> ## Documentation Index > Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL. > Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other. > Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking. > Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify. # Certificate Enrollment Profiles > Create and manage SCEP profiles for 802.1X port-based network access control on nodes. Certificate enrollment profiles define the Simple Certificate Enrollment Protocol (SCEP) configuration that nodes use to obtain and renew certificates for 802.1X port-based network access control (NAC). After you create a profile, projects can reference it to enforce certificate-based authentication on managed nodes. ## Introduction This procedure covers how to create, edit, and delete certificate enrollment profiles. A profile specifies the SCEP server URL, certificate authority (CA), certificate signing request (CSR) parameters, and key and renewal settings. After you create a profile, you assign it to a project as part of the project's 802.1X network access control (NAC) policy. Nodes in that project then use the profile to enroll and renew their certificates automatically. ## Prerequisites * You have the SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md). * You have the SCEP server URL and the CA certificate in PEM format. ## Create a Certificate Enrollment Profile 1. In the header, select your profile avatar, then select **Enterprise Settings**. 2. In the Enterprise Settings navigation, under **Security & Access**, select **Network Access**. 3. In the **Certificate Enrollment Profiles** section, select **Create Profile**. 4. In the **Identity** section, complete the following fields: | Field | Required | Notes | | - | - | - | | Name | Yes | Must start with a letter. Letters, numbers, hyphens, and underscores only. Minimum 2 characters. Cannot be changed after creation. | | Display Title | Yes | Human-readable label. Minimum 2 characters. Auto-populates from the Name field until you edit it directly. | | Description | No | Optional explanation of the profile's purpose. | 5. In the **SCEP and Certificate Authority** section, complete the following fields: | Field | Required | Notes | | - | - | - | | SCEP URL | Yes | The enrollment server URL, for example `https://ca.example.com/scep`. | | Challenge Password | No | A shared secret used by the SCEP server to authorize enrollment requests. Leave blank if your SCEP server does not require a challenge password. | | Use Edge Infrastructure Services proxy | No | When enabled, enrollment requests are routed through Edge Infrastructure Services rather than directly from the node to the SCEP server. | | CA certificate PEM | Yes | The CA certificate in PEM format. Paste the PEM text or click **Upload PEM** to select a `.pem`, `.crt`, or `.cer` file. | 6. In the **CSR Profile** section, configure the certificate subject fields. The **Common Name Template** field uses `{{device.serialNumber}}` by default, which populates the common name with each node's serial number at enrollment time. Adjust the Organization, Organizational Unit, Country, State, Locality, SAN URI, and SAN Email fields as required by your PKI policy. Country must be a two-letter code. 7. In the **Key and Renewal** section, configure the cryptographic settings: | Field | Notes | | - | - | | Key Family | RSA is the supported option. ECDSA support is planned for a future release. | | RSA Key Size | Select RSA 2048, RSA 3072, or RSA 4096. Default: RSA 2048. | | Hash Algorithm | Select SHA-256, SHA-384, or SHA-512. Default: SHA-256. | | Renewal Period (%) | The percentage of the certificate's validity period that must elapse before renewal begins. For example, a value of 50 means renewal starts when half the certificate's lifetime has passed. Default: 50. | 8. Click **Create Profile**. ## Edit a Certificate Enrollment Profile You can edit profiles that are currently in use by one or more projects. Changes to SCEP URL, challenge password, CA certificate, or CSR settings take effect on the next certificate renewal cycle for enrolled nodes. Editing opens in a modal over the page you started from. You can start from the Certificate Enrollment Profiles list, as described in the steps that follow, or from the profile detail page by selecting the **Edit** button (gear icon) in the page header. Both open the same modal. 1. In the header, select your profile avatar, then select **Enterprise Settings**. 2. In the Enterprise Settings navigation, under **Security & Access**, select **Network Access**. 3. In the Certificate Enrollment Profiles list, select the **Edit** button (gear icon) in the profile row. The Edit modal opens over the list. The modal header shows the profile's display title and, below it, the profile name. 4. Update the fields as needed. The **Name** field is not shown in edit mode, because the profile name is set at creation and cannot be changed. If you do not supply a new CA certificate PEM, the existing certificate material is retained. 5. Select **Save Changes** in the modal footer. **Save Changes** stays disabled until the form is valid. To close the modal without saving, select **Cancel**. ## Delete a Certificate Enrollment Profile You cannot delete a profile while it is in use by one or more projects. Remove the profile from all project NAC policies before proceeding. 1. In the Certificate Enrollment Profiles list, select the **Delete** button (trash icon) in the profile row. The delete button is disabled for profiles that are in use. 2. Review the confirmation message: "This action cannot be undone. Devices currently enrolled against this profile will fail to renew their certificates." 3. Select **Delete**. ## Assign a Profile to a Project Certificate enrollment profiles take effect when they are referenced in a project's 802.1X NAC policy. 1. Navigate to your project's settings. 2. In the **Attestation and Device Trust** policy section, locate the **802.1X Port-Based Network Access Control** settings. 3. Set the **EAP Method** to **TLS**. 4. Select the certificate enrollment profile from the **Certificate Enrollment Profile** picker. 5. Optionally, set an **EAP Identity**. 6. Save the project settings. Nodes in the project begin certificate enrollment on their next check-in with Edge Infrastructure Services. ## Verify the Configuration After a profile is created, it appears in the Certificate Enrollment Profiles list with a **Not In Use** status badge. After you assign the profile to a project, the badge changes to **In Use**. To confirm that a specific node has enrolled successfully, navigate to the node's detail page and locate the **Enrolled Certificates** section. The table shows the certificate subject, issuer, status, issue date, and expiry date. A status of **Active** confirms successful enrollment. ## Next Steps > [card] [Enterprise Settings Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/enterprise-settings.md) > > The full context of Device and Network Trust configuration. > [card] [Configure Two-Factor Authentication](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/configure-2fa.md) > > Additional security controls at the enterprise level.