To configure Certificate Enrollment Gateway for MDM Web Service (MDMWS) and MDM-SCEP enrollment, you must configure the MDMWS enrollment settings in Certificate Enrollment Gateway. You can edit the MDMWS enrollment settings using the Management Console interface.

To configure Certificate Enrollment Gateway for MDMWS and MDM-SCEP enrollment

1. Log in into the Management Console as explained in Logging into the Management Console.
2. In the Certificate Enrollment Gateway pane, click Manage Solution.
   A Certificate Enrollment Gateway page appears.
3. In the left navigation bar, click Configuration.
   A Product Configuration pane appears.
4. Turn on Enable Advanced Configuration.
5. Click Next.
6. For all SCEP-related protocols (SCEP, MDM-SCEP, and Intune-SCEP), Certificate Enrollment Gateway uses RA certificates to sign and encrypt SCEP PKI messages. For an on-premises CA, you must specify one or more profiles that are defined in CA Gateway used to issue RA certificates.
   1. Click the CAGW tab.

   2. Configure the RA Certificate Profile IDs setting.

7. Click the MDMWS tab and configure the following settings. 
   • Enable MDMWS
   • MDM-SCEP Token Expire Lifetime
   • MDMWS Expired Token Clean-up Cron Job
   • MDMWS Users
   • MDMWS Enrollment Service Configuration
8. Configure any other settings if required.
9. After configuring the settings, click Validate to validate the settings.
   If any configuration errors are detected, correct the errors then click Validate again.
10. After validating the configuration settings, click Next.
    Entrust PKI Hub uploads the configuration and any attached files, such as P12 credentials.
11. In the Product Deployment Status pane, re-deploy Certificate Enrollment Gateway with the updated configuration file by clicking Deploy.
    A dialog box appears, prompting you to confirm the operation. Click Yes to confirm the operation and deploy the Certificate Enrollment Gateway solution.