Security Tools › PKI & Certificates › Protocols & APIs
SCEP test runner
Paste what your SCEP server and client exchanged (GetCACaps, GetCACert and PKIOperation) and get a green, amber or red result for each step. Decode any SCEP message to see its type, transaction and status.
- 2 free tools
- Nothing uploaded or stored
- RFC 8894
Protocols & APIs
How certificates are requested, issued, constrained and checked — with decoders, builders and ready-to-run commands.
SCEP test runner RFC 8894 · GetCACaps · GetCACert · PKIOperation New
Paste what your SCEP server and client exchanged, and get a green, amber or red result for each step: the server's capabilities, its CA and RA certificates, the client's enrolment request and the server's CertRep answer. The runner checks algorithms, certificate validity and key usage, signatures, and that the request was encrypted to the right certificate and the response matches the request.
SCEP servers do not accept requests from web pages, so this runner works on responses you fetch yourself (commands below). Everything is checked in this tab. The encrypted parts stay encrypted: the runner never needs a private key or your challenge password.
Server responses
Enrolment messages (optional)
- Passed
- Warning
- Failed
- Skipped
SCEP analyser Simple Certificate Enrolment Protocol · RFC 8894 New
SCEP is still common for MDM, routers and VPN clients. Decode a SCEP message to see its type, transaction ID and nonces, check a server's capabilities for weak algorithms, and build test commands.