Skip to main content
Question

JamfSchool SCEP iPad don't renew certificate

  • September 23, 2026
  • 3 replies
  • 73 views
iBush
Forum|alt.badge.img

Hi, hoping someone is able to help!

We’ve successfully deployed SCEP with Jamf School for our iPads. The devices received their certificates correctly and were able to connect to our Wi-Fi.

However, we are now experiencing an issue with certificate renewal around a year later. The certificates are not automatically renewed when they are approaching their expiration date. It seems that Jamf School’s SCEP configuration does not send a new certificate request before the current certificate expires.

As a result, the iPads are dropping off our Wi-Fi and are unable to reconnect once the certificate expires. To get them back online, we have to connect the iPads to another network and then manually push the Wi-Fi profile again through Jamf School.

Other MDM solutions provide an option to specify how many days before expiration a certificate should be renewed, but I can’t find a similar setting in Jamf School.

How can we configure automatic certificate renewal in Jamf School? I’ve looked through the available documentation but couldn’t find any information about this.

Thank you!

    3 replies

    Forum|alt.badge.img+16

    I experienced (experiencing is a better word) this recently. I reached out to support. The AI chatbot was infuriating and kept suggesting I should create a new certificate, attach it to the profile and bob’s your uncle. I kept having to reply, “That’s not how SCEP works”. My hate on LLM’s is for another day though. A rep informed me School does not do anything automatic regarding SCEP cert expiration. What you have to do and what I’ve done is add a version string to your profile. Based on your one year time line you enter a reminder somewhere (Reminders app, calendar, etc.) to change the version string. The re-installation should not cause any device to lose connectivity, but your results may vary so test this first. 

    iBush
    Forum|alt.badge.img
    • iBush
    • Author
    • New Contributor
    • October 12, 2026

    We found that some of the devices were indeed auto renewing but majority of devices were off / sleeping for a couple of days during the start of term. This meant they did not receive the new certificate, we’re unsure of how many days the window for auto renewal is and couldn’t find any clarity online either.

     

    A version string sounds interesting, could you please expand on it? I’d love to understand exactly how you’re using this and where it is in the profile to add. Is it more of a manual thing etc? Apologies, I’m still relatively new and had help setting up the initial SCEP profile! :)

    Forum|alt.badge.img+16

    We found that some of the devices were indeed auto renewing but majority of devices were off / sleeping for a couple of days during the start of term. This meant they did not receive the new certificate, we’re unsure of how many days the window for auto renewal is and couldn’t find any clarity online either.

     

    A version string sounds interesting, could you please expand on it? I’d love to understand exactly how you’re using this and where it is in the profile to add. Is it more of a manual thing etc? Apologies, I’m still relatively new and had help setting up the initial SCEP profile! :)

    The certificate can’t auto renew itself unless the SCEP server is queried which only does so when the profile gets installed. So the profile needs to be reinstalled/reissued before the certificate expires. Jamf Pro does this by reissuing the profile at a hard coded number of days or weeks before expiration. Jamf School does not so to reissue the profile the name needs to be changed. Rather than get cheeky and add or remove spaces, letters or whole words you add a version number or string to the end like the date ex. v101226 or v121026 or really any meaningful string which can be changed without muddying the name of the profile. The end result is the profile gets reissued. Knowing your certificate life expectancy is also a good idea so you ca be prepared.

    Terms & ConditionsAccessibility statement