0x80072F8F is the familiar "A security error occurred" — a secure-channel (TLS) failure.
The device reached the SCEP endpoint but refused to complete the TLS handshake: it does not
trust the server certificate, the certificate does not match the hostname, or the device's
clock is far enough off that certificate validity checks fail.
0x80072F8F
Security error connecting to the SCEP endpoint
What it means
Common causes
The TLS certificate on the SCEP endpoint (or its reverse proxy) is expired, self-signed, or issued by a CA the device does not trust.
Hostname mismatch: the profile URL does not match any SAN on the server certificate.
Device clock skew — a wrong date makes valid certificates appear not-yet-valid or expired.
A TLS-inspection proxy re-signs the connection with a certificate the device does not trust.
How to fix it
Open the SCEP URL in a browser on a failing device and inspect the certificate: issuer, expiry and SAN entries must all check out against the profile URL.
Verify device time:
w32tm /query /status— fix time sync before chasing certificate problems.Serve a certificate from a publicly trusted CA on the external SCEP endpoint, or deploy the issuing chain to devices via a trusted certificate profile before the SCEP profile.
Exempt the SCEP endpoint from TLS inspection on outbound proxies.