Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)
The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.
When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).
When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.
In both cases, a symmetric encryption algorithm is used.