> For the complete documentation index, see [llms.txt](https://docs.radiusaas.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.radiusaas.com/admin-portal/settings/scepman-connection.md).

# SCEPman Connection

### SCEPman Connection

{% hint style="warning" %}
SCEPman Enterprise Edition only

Applicable to version 3.0 and above
{% endhint %}

The **SCEPman Connection** setting connects your RADIUSaaS instance directly to your SCEPman instance so that the RADIUS Server Certificate is issued and renewed automatically. Once the connection is established, RADIUSaaS will:

1. Create and activate a new Server Certificate issued by SCEPman.
2. Manage the lifecycle of that certificate, including its renewal.

This setting is **optional**. If you do not connect a SCEPman instance, you can continue to use the Customer-CA or upload your own certificate as described [here](/admin-portal/settings/settings-server.md#server-certificates).

The status badge next to the section title shows the current state of the integration: **NOT CONNECTED** until the setup is completed, **CONNECTED** afterwards. If you do not have a SCEPman instance yet, use the **Set up SCEPman** link to open the SCEPman deployment documentation.

<figure><img src="/files/WdrKq0kKxCItQBucSL6L" alt=""><figcaption></figcaption></figure>

#### Overview of the setup

The setup consists of three steps, summarized at the top of the section:

| # | Step                             | Description                                                                     |
| - | -------------------------------- | ------------------------------------------------------------------------------- |
| 1 | **Copy this token into SCEPman** | Trust this token by adding it to SCEPman's environment variables.               |
| 2 | **Enter your SCEPman URL**       | The base URL of your SCEPman instance.                                          |
| 3 | **Pregenerate a certificate**    | Optional: verify that SCEPman issues a certificate before you finish the setup. |

#### 1. Token

The **Token** field contains the API token that RADIUSaaS uses to authenticate against your SCEPman instance. The token is generated by RADIUSaaS and shown masked by default.

* Click the **eye** icon to reveal the token.
* Click the **copy** icon to copy it to your clipboard.

{% hint style="info" %}
The token is read-only. It cannot be set or changed in the RADIUSaaS Admin Portal — you only enter it on the SCEPman side.
{% endhint %}

Transfer the token to SCEPman by creating the application setting [AppConfig:RADIUSaaSValidation:Token](https://docs.scepman.com/scepman-configuration/application-settings/scep-endpoints/radiusaas) in your SCEPman App Service, as described in [this guide](https://docs.scepman.com/scepman-configuration/application-settings#convenient-configuration-in-the-app-service-configuration). We recommend storing the value as a secret in Azure Key Vault using the name `AppConfig--RADIUSaaSValidation--Token`. Apply the settings and restart your App Service afterwards.

#### 2. SCEPman URL

Enter the base URL of your SCEPman instance, for example `https://<your-scepman-instance>.azurewebsites.net`. The **Connect** button stays disabled until a URL has been entered.

#### 3. Pregenerate a certificate (optional)

Before finishing the setup, you can let RADIUSaaS request a test certificate from SCEPman. This confirms that the token and the URL are correct and that SCEPman is able to issue a certificate. The pregenerated certificate is added to your Server Certificates but is **not activated**.

<figure><img src="/files/T3tQZoZp6Cj139exuRof" alt=""><figcaption></figcaption></figure>

#### Connect

Click **Connect** to establish the connection.

{% hint style="warning" %}
This action deactivates the currently active server certificate so that the newly issued certificate can be managed by RADIUSaaS. Ensure that your clients and RadSec-enabled authenticators trust the SCEPman Root CA before you connect, otherwise authentication will fail.
{% endhint %}

After a successful setup, the status changes to **CONNECTED,** and two additional actions become available:

* **Rotate Certificate:** rotates and activates your server certificate.
* **Delete Connection:** removes the configured connection. This also deletes the token and cannot be undone. To set up the connection again later, you must repeat the steps above.

**Note:** A new token will be automatically created after deleting the connection.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.radiusaas.com/admin-portal/settings/scepman-connection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.