The SCEP (NDES) client should have the ability to support using a username and password to dynamically retrieve a challenge password. It isn’t suitable for some institutions to utilize a static password where not all devices are trusted.