Self-host SCEP, ACME, and EST certificate issuance for MDM fleets, servers, and private infrastructure, with keys protected by the cloud KMS you control.
SimpleSCEP gives teams automated certificate enrollment, renewal, revocation, and lifecycle management while keeping the deployment and trust boundary under their control.
A private CA is only as trustworthy as the account and infrastructure that administer it. Security capabilities are part of the project, not paid upgrades.
SimpleSCEP is built on a foundation of security best practices to ensure your infrastructure is protected.
Revoking, rotating, and deleting ask you to prove it is still you, even mid-session.
Every action is recorded and exportable whenever an auditor asks for it.
Choose software- or HSM-backed CA keys for each authority using Google Cloud KMS or Azure Key Vault.
CRL and OCSP responders answer independently of the dashboard, so revocation keeps working even when other things do not.
Certificates nearing expiry raise an email to your team, on a threshold you choose.
SimpleSCEP is available under Apache License 2.0. Run it in your environment, inspect the complete implementation, and contribute through GitHub.
SCEP for MDM and device enrollment, ACME for private server certificates, and EST for enrollment and re-enrollment. ACME accounts authorise with External Account Binding rather than public domain validation.
IT, security, platform, and infrastructure teams managing device fleets, internal servers, IoT devices, and private certificate authorities.
Any MDM that speaks SCEP. Microsoft Intune and Jamf Pro have connectors built in — Intune with an admin-consent flow and an automatic revocation sweep, Jamf Pro with dynamic challenges — and everything else enrolls against a standard SCEP endpoint with a shared secret or one-time challenge.
You run SimpleSCEP in your own environment with PostgreSQL and either Google Cloud KMS or Azure Key Vault for production key protection. A disposable local mode is available for development.
Yes. You can create a new hierarchy or import an existing root or issuing CA so your current trust chain keeps working.
Yes. Each certificate authority can independently use software- or HSM-backed keys through Google Cloud KMS or Azure Key Vault.
A production deployment uses PostgreSQL, Resend, HTTPS, and either Google Cloud KMS or Azure Key Vault for non-exportable CA keys and encrypted application secrets.
