Under some circumstances, if a Root CA certificate is pushed to the device, the SCEP enrollment may fail with the error "The Registration Authority’s response is invalid."

More...