Fortunato wrote: Dogtag 1.1.0 is the open source development project of the released commercial product RHCS 7.3. One way to get an idea of the changes, is to go through the archive lists: https://www.redhat.com/mailman/private/pki-commits/ In the RA's "SSL End Users Services" page, there should be a "SCEP Enrollment" link, url looks like this: https://<fqdn:port>/ee/index.cgi (default port 12899) Also by default, a CA EE enrollment pages and "List Certificate Profiles" will list the caRouterCert and caRARouterCert profiles. ** Should not, seem quite strange if you do not see those. ok, so you want to use SCEP with a RA. Those are for SSL sub system certificates. The Request Submission is to get the one time pin for the device. The SCEP Enrollment page shows the link to configure on the device. Those 2 are listed in the "EE" pages of the RA instance. See the profiles like in the directory /var/lib/rhpki-<ca-instance-id>/profiles/ca/caRA* Specially caRARouterCert profile on the CA instance (caRouterCert s for CA mode). Some pointers: http://www.redhat.com/docs/manuals/cert-system/7.3/html/Administration_Gu... http://pki.fedoraproject.org/wiki/PKI_SCEP_Support_In_Certificate_System http://pki.fedoraproject.org/wiki/PKI_Cisco_Routers_%28IOS%29