A computer implemented method for validating SCEP, Simple Certificate Enrollment Protocol, certificate enrollment requests, said method comprising the steps of, in combination: (a) electronically receiving a request from a trusted user for a SCEP challenge to be used in a subsequent certificate request and, in response to the request, registering the SCEP challenge by generating and storing the SCEP challenge and associated expected certificate content for the SCEP challenge, and sending the SCEP challenge to the trusted user; (b) after step (a), electronically receiving a certificate request including the SCEP challenge via a communications network; (c) electronically validating the certificate request by checking whether a the SCEP challenge of the certificate request was previously registered and if so checking whether content of the certificate request matches the previously registered expected certificate content associated with the previously registered SCEP challenge; (d) after step (c), authorizing a certificate for the certificate request if the SCEP challenge of the certificate request was previously registered and the content of the certificate request matches the previously registered expected certificate content associated with the previously registered SCEP challenge, and generating and sending the certificate via the communications network to a sender of the certificate request; and (e) after step (c), denying the certificate request if the SCEP challenge of the certificate request was not previously registered or if the content of the certificate request does not match the previously registered expected certificate content associated with the previously registered SCEP challenge. (a) electronically receiving a request from a trusted user for a SCEP challenge to be used in a subsequent certificate request and, in response to the request, registering the SCEP challenge by generating and storing the SCEP challenge and associated expected certificate content for the SCEP challenge, and sending the SCEP challenge to the trusted user; (b) after step (a), electronically receiving a certificate request including the SCEP challenge via a communications network; (c) electronically validating the certificate request by checking whether a the SCEP challenge of the certificate request was previously registered and if so checking whether content of the certificate request matches the previously registered expected certificate content associated with the previously registered SCEP challenge; (d) after step (c), authorizing a certificate for the certificate request if the SCEP challenge of the certificate request was previously registered and the content of the certificate request matches the previously registered expected certificate content associated with the previously registered SCEP challenge, and generating and sending the certificate via the communications network to a sender of the certificate request; and (e) after step (c), denying the certificate request if the SCEP challenge of the certificate request was not previously registered or if the content of the certificate request does not match the previously registered expected certificate content associated with the previously registered SCEP challenge.