{"id":27893,"date":"2026-04-09T01:27:46","date_gmt":"2026-04-09T01:27:46","guid":{"rendered":"https:\/\/www.insentragroup.com\/au\/?p=27893"},"modified":"2026-04-10T00:35:07","modified_gmt":"2026-04-10T00:35:07","slug":"root-certificate-renewal-the-scep-failure-we-didnt-expect","status":"publish","type":"post","link":"https:\/\/www.insentragroup.com\/au\/insights\/geek-speak\/secure-workplace\/root-certificate-renewal-the-scep-failure-we-didnt-expect\/","title":{"rendered":"Root Certificate Renewal: The SCEP Failure We Didn\u2019t Expect"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction&nbsp;<\/h2>\n\n\n\n<p>Certificate renewals are supposed to be boring.&nbsp;<\/p>\n\n\n\n<p>Planned. Routine. Low\u2011risk.&nbsp;<\/p>\n\n\n\n<p>Even when a&nbsp;Root CA certificate is renewed using the existing key pair, most environments expect business as usual certificates continue to be issued, devices stay connected, and users remain unaware that anything changed.&nbsp;<\/p>\n\n\n\n<p>However, in environments using&nbsp;Microsoft Intune with SCEP, even a Root CA renewal&nbsp;that&nbsp;retains&nbsp;the same key pair&nbsp;can introduce an unexpected failure mode.&nbsp;SCEP&nbsp;enrollments&nbsp;begin to fail, newly provisioned Windows devices are unable to authenticate to the network, and Intune starts reporting certificate deployment errors \u2014 all without any policy or configuration changes.&nbsp;<\/p>\n\n\n\n<p>At first glance, nothing&nbsp;appears broken:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>NDES (Network Device&nbsp;Enrollment&nbsp;Service) is running<\/li>\n\n\n\n<li>The Intune Certificate Connector is healthy<\/li>\n\n\n\n<li>The NAC (Network Access Control) is online and enforcing access policies&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>Yet despite everything looking correct, certificate&nbsp;enrollment&nbsp;and EAP\u2011TLS authentication continue to fail&nbsp;\u2014&nbsp;a lesson learned the hard way.&nbsp;<\/p>\n\n\n\n<p>The underlying issue turns out to be deceptively simple:&nbsp;a missing or outdated trust relationship on the device following the Root CA renewal, even though the key pair itself did not change.&nbsp;<\/p>\n\n\n\n<p>This post walks through the&nbsp;environment setup, the&nbsp;symptoms, the root cause, and the&nbsp;validated fix, helping avoid a common SCEP failure that often only surfaces after certificates stop deploying.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Overview of the Setup&nbsp;<\/h2>\n\n\n\n<p>This issue commonly appears in environments using&nbsp;Microsoft Intune,&nbsp;SCEP, and a&nbsp;third\u2011party Network Access Control (NAC) platform for certificate\u2011based network authentication.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Intune\u2019s role&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Deploys the&nbsp;trusted Root CA certificate&nbsp;<\/li>\n\n\n\n<li>Deploys&nbsp;SCEP\u2011issued certificates&nbsp;(device or user)<\/li>\n\n\n\n<li>Deploys the&nbsp;Wi\u2011Fi profile&nbsp;using&nbsp;EAP\u2011TLS<\/li>\n\n\n\n<li>Provides&nbsp;device identity and trust<\/li>\n\n\n\n<li>Does&nbsp;not&nbsp;enforce network access&nbsp;<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3rd\u2011party NAC\u2019s role<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Acts as the&nbsp;RADIUS server&nbsp;for 802.1X authentication&nbsp;<\/li>\n\n\n\n<li>Validates certificates during&nbsp;EAP\u2011TLS<\/li>\n\n\n\n<li>Enforces network access policies:\n<ul class=\"wp-block-list\">\n<li>VLANs<\/li>\n\n\n\n<li>Roles<\/li>\n\n\n\n<li>ACLs<\/li>\n\n\n\n<li>Quarantine \/ remediation<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Optionally evaluates&nbsp;Intune compliance or posture&nbsp;<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Authentication flow&nbsp;<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Intune installs:&nbsp;\n<ul class=\"wp-block-list\">\n<li>Root CA certificate&nbsp;<\/li>\n\n\n\n<li>SCEP\u2011issued certificate&nbsp;<\/li>\n\n\n\n<li>Wi\u2011Fi profile (EAP\u2011TLS)&nbsp;<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Device connects to the network using&nbsp;EAP\u2011TLS&nbsp;<\/li>\n\n\n\n<li>NAC&nbsp;validates&nbsp;the certificate chain and attributes&nbsp;<\/li>\n\n\n\n<li>NAC grants or denies network access&nbsp;<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"704\" src=\"https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/root-cert-renewal-img-111-1024x704.png\" alt=\"\" class=\"wp-image-27896\" title=\"\" srcset=\"https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/root-cert-renewal-img-111-1024x704.png 1024w, https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/root-cert-renewal-img-111-300x206.png 300w, https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/root-cert-renewal-img-111-768x528.png 768w, https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/root-cert-renewal-img-111.png 1487w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Common patterns&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Device\u2011based certificates (most common)&nbsp;\n<ul class=\"wp-block-list\">\n<li>Best for corporate devices and pre\u2011logon access&nbsp;<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>User\u2011based certificates&nbsp;\n<ul class=\"wp-block-list\">\n<li>Typically used for BYOD&nbsp;<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Hybrid approaches&nbsp;\n<ul class=\"wp-block-list\">\n<li>Certificate authentication plus Intune compliance checks&nbsp;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Note<\/h3>\n\n\n\n<p>Intune provisions and configures certificates; the NAC authenticates and enforces access.&nbsp;<\/p>\n\n\n\n<p>This separation of responsibility is crucial to understanding the failure. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Problem&nbsp;<\/h2>\n\n\n\n<p>After renewing the&nbsp;Root CA or Issuing CA certificate, SCEP certificate deployment to Windows devices begins to fail.&nbsp;<\/p>\n\n\n\n<p>No Intune configuration changes were made, yet:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>New certificates are not issued<\/li>\n\n\n\n<li>Devices fail EAP\u2011TLS authentication<\/li>\n\n\n\n<li>Network access is denied<\/li>\n\n\n\n<li>Intune reports SCEP profile failures&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Symptoms&nbsp;<\/h2>\n\n\n\n<p>Following the CA renewal, administrators&nbsp;observe:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Failed&nbsp;SCEP certificate deployments&nbsp;in Intune&nbsp;<\/li>\n\n\n\n<li>Windows devices unable to&nbsp;enroll&nbsp;for certificates&nbsp;<\/li>\n\n\n\n<li>Errors appearing locally on the device after renewal&nbsp;<\/li>\n\n\n\n<li>Existing certificates continuing to work until expiry&nbsp;<\/li>\n\n\n\n<li>Newly enrolled or reprovisioned devices failing network authentication&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>This is commonly seen in environments using:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>NDES&nbsp;<\/li>\n\n\n\n<li>Intune Certificate Connector&nbsp;<\/li>\n\n\n\n<li>A third\u2011party NAC relying on certificate trust&nbsp;<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Error Observed on the Device<\/h3>\n\n\n\n<p>On affected Windows devices, the error is visible in Event Viewer at:&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Applications and Services Logs \u2192 Microsoft \u2192 Windows \u2192&nbsp;DeviceManagement\u2011Enterprise\u2011Diagnostics\u2011Provider&nbsp;\u2192&nbsp;Admin&nbsp;<\/code><\/pre>\n\n\n\n<p>In this log, the device records Event ID 307 errors during SCEP enrollment. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"495\" src=\"https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/image-1024x495.png\" alt=\"\" class=\"wp-image-27899\" title=\"\" srcset=\"https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/image-1024x495.png 1024w, https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/image-300x145.png 300w, https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/image-768x371.png 768w, https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/image.png 1100w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Root Cause&nbsp;<\/h2>\n\n\n\n<p>The issue is caused by&nbsp;certificate trust not being refreshed on Windows devices after the Root CA renewal, even when the renewal is performed using the existing key pair.&nbsp;<\/p>\n\n\n\n<p>When a&nbsp;Root CA or Issuing CA certificate is renewed:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The certificate&nbsp;validity period and metadata change&nbsp;<\/li>\n\n\n\n<li>The renewed certificate is published and used by&nbsp;NDES and the Intune Certificate Connector<\/li>\n\n\n\n<li>Windows devices do not automatically update or re\u2011trust the renewed CA certificate&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>Even though the&nbsp;private\/public key pair&nbsp;remains&nbsp;the same, the renewed certificate is still treated as a&nbsp;new certificate instance&nbsp;from a trust perspective. If the updated certificate is not redeployed to devices:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The SCEP server certificate chain cannot be fully validated&nbsp;<\/li>\n\n\n\n<li>SCEP&nbsp;enrollment&nbsp;fails during certificate issuance&nbsp;<\/li>\n\n\n\n<li>Intune reports the SCEP profile as failed&nbsp;<\/li>\n\n\n\n<li>The NAC never receives a valid certificate to authenticate&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>This confirms the issue is&nbsp;not related to key pair changes, but rather to&nbsp;certificate trust distribution and lifecycle handling&nbsp;on managed devices.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Note<\/h3>\n\n\n\n<p>Renewing a Root CA with the existing key pair does not&nbsp;eliminate&nbsp;the need to redeploy the trusted certificate to endpoints.&nbsp;<\/p>\n\n\n\n<p>Devices must explicitly trust the renewed certificate, regardless of whether the key pair changed.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Network Access Breaks&nbsp;<\/h2>\n\n\n\n<p>EAP\u2011TLS authentication is entirely dependent on trust:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The&nbsp;device must trust the CA&nbsp;<\/li>\n\n\n\n<li>The&nbsp;NAC must trust the same CA&nbsp;<\/li>\n\n\n\n<li>Any mismatch breaks authentication&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>After renewal, the NAC often trusts the updated CA, while&nbsp;Windows devices do not, creating a one\u2011sided trust failure that prevents SCEP&nbsp;enrollment&nbsp;and network access.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Fix&nbsp;&nbsp;<\/h2>\n\n\n\n<p>To resolve the issue.\u00a0<\/p>\n\n\n\n<p>Reinstall both the&nbsp;Network Device&nbsp;Enrollment&nbsp;Service (NDES) server role and the&nbsp;Microsoft Intune Certificate Connector&nbsp;on the NDES server.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">During reinstallation<strong>&nbsp;<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>New RA&nbsp;(Registration Authority)&nbsp;certificates are automatically reissued&nbsp;<\/li>\n\n\n\n<li>NDES is re\u2011registered with the renewed CA certificate&nbsp;<\/li>\n\n\n\n<li>Trust is re\u2011established&nbsp;between:&nbsp;\n<ul class=\"wp-block-list\">\n<li>NDES&nbsp;<\/li>\n\n\n\n<li>The Certificate Authority&nbsp;<\/li>\n\n\n\n<li>Microsoft Intune&nbsp;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p>Once the RA certificates are refreshed, SCEP certificate deployment to Windows devices resumes successfully.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Important: Update the MSCEP Registry Configuration&nbsp;<\/h3>\n\n\n\n<p>After the NDES and Intune Certificate Connector installation wizard completes, do not forget to update the MSCEP registry configuration on the NDES server.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Registry Location<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MSCEP\\ <\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">What Needs to Be Updated<\/h3>\n\n\n\n<p>NDES maps SCEP requests to certificate templates using registry values. These values&nbsp;must match the certificate template name&nbsp;(not the display name) used by your SCEP profile in Intune.&nbsp;<\/p>\n\n\n\n<p>To update the registry:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Identify&nbsp;the&nbsp;Purpose&nbsp;of the certificate template&nbsp;(found on the Request Handling tab of the template)&nbsp;<\/li>\n\n\n\n<li>Update the corresponding registry value with the&nbsp;template name<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certificate Template Purpose Mapping&nbsp;<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td style=\"color: #fff; background-color: #F35905;\"><strong>Certificate Template Purpose&nbsp;<\/strong>&nbsp;<\/td><td style=\"color: #fff; background-color: #F35905;\"><strong>Registry Value to Edit<\/strong>&nbsp;<\/td><td style=\"color: #fff; background-color: #F35905;\"><strong>Value Seen in Intune SCEP Profile<\/strong>&nbsp;<\/td><\/tr><tr><td>Signature&nbsp;<\/td><td>SignatureTemplate&nbsp;<\/td><td>Digital Signature&nbsp;<\/td><\/tr><tr><td>Encryption&nbsp;<\/td><td>EncryptionTemplate&nbsp;<\/td><td>Key Encipherment&nbsp;<\/td><\/tr><tr><td>Signature and encryption&nbsp;<\/td><td>GeneralPurposeTemplate&nbsp;<\/td><td>Digital Signature \/ Key Encipherment&nbsp;<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What Happens If the Registry Is Not Updated&nbsp;<\/h2>\n\n\n\n<p>If the&nbsp;MSCEP&nbsp;(Microsoft Simple Certificate Enrollment Protocol) registry values are not updated&nbsp;after reinstalling NDES and the Microsoft Intune Certificate Connector, the environment may appear to be fully functional again&nbsp;but authentication will still fail.&nbsp;<\/p>\n\n\n\n<p>In this scenario:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>NDES and the Intune Certificate Connector are installed successfully&nbsp;<\/li>\n\n\n\n<li>RA certificates are reissued&nbsp;<\/li>\n\n\n\n<li>Intune SCEP, Trusted Certificate, and Wi\u2011Fi profiles are&nbsp;successfully delivered to the device&nbsp;<\/li>\n\n\n\n<li>The device receives a certificate&nbsp;<\/li>\n\n\n\n<li>Wi\u2011Fi authentication using EAP\u2011TLS still fails&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>This can be misleading, as Intune shows no deployment errors, yet the device cannot authenticate to the network.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Evidence on the NDES Server (Wrong Template Used)<strong>&nbsp;<\/strong><\/h3>\n\n\n\n<p>When this occurs, the issue is visible in&nbsp;Event Viewer on the NDES server, under: Event Viewer<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Applications and Services Logs \u2192 Microsoft \u2192 Intune \u2192 CertificateConnectors \u2192 Operational <\/code><\/pre>\n\n\n\n<p>In this log, Event ID 4004 entries show that the SCEP request was processed successfully, but the wrong certificate template was used. The event details include a line&nbsp;similar to:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"609\" src=\"https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/image-1-1024x609.png\" alt=\"\" class=\"wp-image-27906\" title=\"\" srcset=\"https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/image-1-1024x609.png 1024w, https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/image-1-300x178.png 300w, https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/image-1-768x457.png 768w, https:\/\/www.insentragroup.com\/au\/wp-content\/uploads\/sites\/22\/2026\/04\/image-1.png 1101w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>This&nbsp;indicates&nbsp;that:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>NDES is processing SCEP requests&nbsp;<\/li>\n\n\n\n<li>The request is valid&nbsp;<\/li>\n\n\n\n<li>The certificate is being issued using an unexpected or incorrect template&nbsp;<\/li>\n\n\n\n<li>The template does not match the one configured for the Intune SCEP profile&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>As a result, the issued certificate does not meet the requirements for EAP\u2011TLS authentication, and network access is denied.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why This Fix Works&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>RA certificates are tightly bound to the CA certificate state&nbsp;<\/li>\n\n\n\n<li>NDES does&nbsp;not automatically regenerate RA&nbsp;certificates&nbsp;after a CA renewal&nbsp;<\/li>\n\n\n\n<li>Reinstalling NDES and the Intune Certificate Connector is the only&nbsp;supported method&nbsp;to force RA certificate reissuance&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>Even when the Root CA is renewed using the&nbsp;existing key pair, RA certificates can still become invalid from a trust perspective.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Takeaways&nbsp;<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Renewing a Root CA is&nbsp;not a zero\u2011impact operation for Intune SCEP&nbsp;<\/li>\n\n\n\n<li>Using the&nbsp;existing key pair does not prevent failures&nbsp;<\/li>\n\n\n\n<li>SCEP failures after CA renewal can originate&nbsp;on the NDES server, not the device&nbsp;<\/li>\n\n\n\n<li>The Microsoft\u2011supported fix is to&nbsp;reinstall NDES and the Intune Certificate Connector&nbsp;<\/li>\n\n\n\n<li>Plan CA renewals with&nbsp;NDES remediation steps included&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>Insentra\u2019s&nbsp;Modern Workplace team helps organisations get ahead of challenges across the Microsoft stack before they become critical issues. Whether you are planning a CA renewal, resolving SCEP failures, or building robust runbooks for the future, we are here to help. <a href=\"https:\/\/www.insentragroup.com\/au\/contact\/\" target=\"_blank\" rel=\"noreferrer noopener\">Contact<\/a>&nbsp;our team to ensure your environment is secure, resilient and ready for what comes next.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Reference&nbsp;<\/h2>\n\n\n\n<p>Microsoft official guidance:&nbsp;<a href=\"https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/mem\/intune\/certificates\/scep-deployment-to-win10-devices-fails\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">SCEP deployment to Windows 10 devices fails after you renew the CA certificate<\/a>&nbsp;<\/p>\n\n\n\n<style>\nbody .blog-body h3 {\n    text-transform: none !important;\n}\n<\/style>\n","protected":false},"excerpt":{"rendered":"<p>Introduction&nbsp; Certificate renewals are supposed to be boring.&nbsp; Planned. Routine. Low\u2011risk.&nbsp; Even when a&nbsp;Root CA certificate is renewed using the existing key pair, most environments expect business as usual certificates continue to be issued, devices stay connected, and users remain unaware that anything changed.&nbsp; However, in environments using&nbsp;Microsoft Intune with SCEP, even a Root CA&hellip; <a class=\"more-link\" href=\"https:\/\/www.insentragroup.com\/au\/insights\/geek-speak\/secure-workplace\/root-certificate-renewal-the-scep-failure-we-didnt-expect\/\">Continue reading <span class=\"screen-reader-text\">Root Certificate Renewal: The SCEP Failure We Didn\u2019t Expect<\/span><\/a><\/p>\n","protected":false},"author":151,"featured_media":27911,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[20],"tags":[],"class_list":["post-27893","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-secure-workplace","entry"],"_links":{"self":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts\/27893","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/users\/151"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/comments?post=27893"}],"version-history":[{"count":10,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts\/27893\/revisions"}],"predecessor-version":[{"id":27914,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts\/27893\/revisions\/27914"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/media\/27911"}],"wp:attachment":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/media?parent=27893"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/categories?post=27893"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/tags?post=27893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}