Question regarding Intune configured ValidityTime in the SCEP profile

[nagappa2011]

Hi Everyone,

I'm trying to understand the call flow between Intune-managed devices and a third-party CA integrated via the SCEP protocol. In Intune, we configure the certificate validity period within the SCEP profile — how is this validity period applied by the third-party CA when issuing the certificate?

From my understanding, this information cannot be included in the CSR of the SCEP request. Does the SCEP CA receive the validity information as part of the CSR validation (CSRValidation) request instead?

If so, could someone please share an example of the validation request or response where this field is provided?

Thanks
Nagappa

[bb-froggy]

It is part of the CSR. It is added as the enrollment name/value pairs ValidityPeriod and ValidityPeriodUnits.

Note that it does not work on Apple devices and that the two values are switched on Android.