diff --git a/admin.pb.go b/admin.pb.go
index df12473..3ff1eb8 100644
--- a/admin.pb.go
+++ b/admin.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.31.0
-// 	protoc        v4.23.4
+// 	protoc        v4.24.3
 // source: linkedca/admin.proto
 
 package linkedca
diff --git a/config.pb.go b/config.pb.go
index fb2b783..5513878 100644
--- a/config.pb.go
+++ b/config.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.31.0
-// 	protoc        v4.23.4
+// 	protoc        v4.24.3
 // source: linkedca/config.proto
 
 package linkedca
diff --git a/eab.pb.go b/eab.pb.go
index 7718f03..c9b1860 100644
--- a/eab.pb.go
+++ b/eab.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.31.0
-// 	protoc        v4.23.4
+// 	protoc        v4.24.3
 // source: linkedca/eab.proto
 
 package linkedca
diff --git a/majordomo.pb.go b/majordomo.pb.go
index 91e8a69..9809ef7 100644
--- a/majordomo.pb.go
+++ b/majordomo.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.31.0
-// 	protoc        v4.23.4
+// 	protoc        v4.24.3
 // source: linkedca/majordomo.proto
 
 package linkedca
diff --git a/majordomo_grpc.pb.go b/majordomo_grpc.pb.go
index a3032e5..5388280 100644
--- a/majordomo_grpc.pb.go
+++ b/majordomo_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.3.0
-// - protoc             v4.23.4
+// - protoc             v4.24.3
 // source: linkedca/majordomo.proto
 
 package linkedca
diff --git a/policy.pb.go b/policy.pb.go
index 8576af2..699ca2e 100644
--- a/policy.pb.go
+++ b/policy.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.31.0
-// 	protoc        v4.23.4
+// 	protoc        v4.24.3
 // source: linkedca/policy.proto
 
 package linkedca
diff --git a/provisioners.pb.go b/provisioners.pb.go
index 5b94c07..2928ceb 100644
--- a/provisioners.pb.go
+++ b/provisioners.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.31.0
-// 	protoc        v4.23.4
+// 	protoc        v4.24.3
 // source: linkedca/provisioners.proto
 
 package linkedca
@@ -211,6 +211,7 @@ const (
 	Webhook_ENRICHING     Webhook_Kind = 1
 	Webhook_AUTHORIZING   Webhook_Kind = 2
 	Webhook_SCEPCHALLENGE Webhook_Kind = 3
+	Webhook_NOTIFYING     Webhook_Kind = 4
 )
 
 // Enum value maps for Webhook_Kind.
@@ -220,12 +221,14 @@ var (
 		1: "ENRICHING",
 		2: "AUTHORIZING",
 		3: "SCEPCHALLENGE",
+		4: "NOTIFYING",
 	}
 	Webhook_Kind_value = map[string]int32{
 		"NO_KIND":       0,
 		"ENRICHING":     1,
 		"AUTHORIZING":   2,
 		"SCEPCHALLENGE": 3,
+		"NOTIFYING":     4,
 	}
 )
 
@@ -253,7 +256,7 @@ func (x Webhook_Kind) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use Webhook_Kind.Descriptor instead.
 func (Webhook_Kind) EnumDescriptor() ([]byte, []int) {
-	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{22, 0}
+	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{23, 0}
 }
 
 type Webhook_CertType int32
@@ -302,7 +305,7 @@ func (x Webhook_CertType) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use Webhook_CertType.Descriptor instead.
 func (Webhook_CertType) EnumDescriptor() ([]byte, []int) {
-	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{22, 1}
+	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{23, 1}
 }
 
 type Provisioner struct {
@@ -1710,23 +1713,96 @@ func (*SSHPOPProvisioner) Descriptor() ([]byte, []int) {
 	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{17}
 }
 
+type SCEPDecrypter struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Certificate []byte `protobuf:"bytes,1,opt,name=certificate,proto3" json:"certificate,omitempty"`
+	Key         []byte `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty"`
+	KeyUri      string `protobuf:"bytes,3,opt,name=key_uri,json=keyUri,proto3" json:"key_uri,omitempty"`
+	KeyPassword []byte `protobuf:"bytes,4,opt,name=key_password,json=keyPassword,proto3" json:"key_password,omitempty"`
+}
+
+func (x *SCEPDecrypter) Reset() {
+	*x = SCEPDecrypter{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_linkedca_provisioners_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SCEPDecrypter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SCEPDecrypter) ProtoMessage() {}
+
+func (x *SCEPDecrypter) ProtoReflect() protoreflect.Message {
+	mi := &file_linkedca_provisioners_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SCEPDecrypter.ProtoReflect.Descriptor instead.
+func (*SCEPDecrypter) Descriptor() ([]byte, []int) {
+	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *SCEPDecrypter) GetCertificate() []byte {
+	if x != nil {
+		return x.Certificate
+	}
+	return nil
+}
+
+func (x *SCEPDecrypter) GetKey() []byte {
+	if x != nil {
+		return x.Key
+	}
+	return nil
+}
+
+func (x *SCEPDecrypter) GetKeyUri() string {
+	if x != nil {
+		return x.KeyUri
+	}
+	return ""
+}
+
+func (x *SCEPDecrypter) GetKeyPassword() []byte {
+	if x != nil {
+		return x.KeyPassword
+	}
+	return nil
+}
+
 type SCEPProvisioner struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	ForceCn                       bool     `protobuf:"varint,1,opt,name=force_cn,json=forceCn,proto3" json:"force_cn,omitempty"`
-	Challenge                     string   `protobuf:"bytes,2,opt,name=challenge,proto3" json:"challenge,omitempty"`
-	Capabilities                  []string `protobuf:"bytes,3,rep,name=capabilities,proto3" json:"capabilities,omitempty"`
-	MinimumPublicKeyLength        int32    `protobuf:"varint,4,opt,name=minimum_public_key_length,json=minimumPublicKeyLength,proto3" json:"minimum_public_key_length,omitempty"`
-	IncludeRoot                   bool     `protobuf:"varint,5,opt,name=include_root,json=includeRoot,proto3" json:"include_root,omitempty"`
-	EncryptionAlgorithmIdentifier int32    `protobuf:"varint,6,opt,name=encryption_algorithm_identifier,json=encryptionAlgorithmIdentifier,proto3" json:"encryption_algorithm_identifier,omitempty"`
+	ForceCn                       bool           `protobuf:"varint,1,opt,name=force_cn,json=forceCn,proto3" json:"force_cn,omitempty"`
+	Challenge                     string         `protobuf:"bytes,2,opt,name=challenge,proto3" json:"challenge,omitempty"`
+	Capabilities                  []string       `protobuf:"bytes,3,rep,name=capabilities,proto3" json:"capabilities,omitempty"`
+	MinimumPublicKeyLength        int32          `protobuf:"varint,4,opt,name=minimum_public_key_length,json=minimumPublicKeyLength,proto3" json:"minimum_public_key_length,omitempty"`
+	IncludeRoot                   bool           `protobuf:"varint,5,opt,name=include_root,json=includeRoot,proto3" json:"include_root,omitempty"`
+	EncryptionAlgorithmIdentifier int32          `protobuf:"varint,6,opt,name=encryption_algorithm_identifier,json=encryptionAlgorithmIdentifier,proto3" json:"encryption_algorithm_identifier,omitempty"`
+	Decrypter                     *SCEPDecrypter `protobuf:"bytes,7,opt,name=decrypter,proto3" json:"decrypter,omitempty"`
+	ExcludeIntermediate           bool           `protobuf:"varint,8,opt,name=exclude_intermediate,json=excludeIntermediate,proto3" json:"exclude_intermediate,omitempty"`
 }
 
 func (x *SCEPProvisioner) Reset() {
 	*x = SCEPProvisioner{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_linkedca_provisioners_proto_msgTypes[18]
+		mi := &file_linkedca_provisioners_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1739,7 +1815,7 @@ func (x *SCEPProvisioner) String() string {
 func (*SCEPProvisioner) ProtoMessage() {}
 
 func (x *SCEPProvisioner) ProtoReflect() protoreflect.Message {
-	mi := &file_linkedca_provisioners_proto_msgTypes[18]
+	mi := &file_linkedca_provisioners_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1752,7 +1828,7 @@ func (x *SCEPProvisioner) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SCEPProvisioner.ProtoReflect.Descriptor instead.
 func (*SCEPProvisioner) Descriptor() ([]byte, []int) {
-	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{18}
+	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *SCEPProvisioner) GetForceCn() bool {
@@ -1797,6 +1873,20 @@ func (x *SCEPProvisioner) GetEncryptionAlgorithmIdentifier() int32 {
 	return 0
 }
 
+func (x *SCEPProvisioner) GetDecrypter() *SCEPDecrypter {
+	if x != nil {
+		return x.Decrypter
+	}
+	return nil
+}
+
+func (x *SCEPProvisioner) GetExcludeIntermediate() bool {
+	if x != nil {
+		return x.ExcludeIntermediate
+	}
+	return false
+}
+
 type NebulaProvisioner struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1808,7 +1898,7 @@ type NebulaProvisioner struct {
 func (x *NebulaProvisioner) Reset() {
 	*x = NebulaProvisioner{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_linkedca_provisioners_proto_msgTypes[19]
+		mi := &file_linkedca_provisioners_proto_msgTypes[20]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1821,7 +1911,7 @@ func (x *NebulaProvisioner) String() string {
 func (*NebulaProvisioner) ProtoMessage() {}
 
 func (x *NebulaProvisioner) ProtoReflect() protoreflect.Message {
-	mi := &file_linkedca_provisioners_proto_msgTypes[19]
+	mi := &file_linkedca_provisioners_proto_msgTypes[20]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1834,7 +1924,7 @@ func (x *NebulaProvisioner) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NebulaProvisioner.ProtoReflect.Descriptor instead.
 func (*NebulaProvisioner) Descriptor() ([]byte, []int) {
-	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{19}
+	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *NebulaProvisioner) GetRoots() [][]byte {
@@ -1856,7 +1946,7 @@ type BasicAuth struct {
 func (x *BasicAuth) Reset() {
 	*x = BasicAuth{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_linkedca_provisioners_proto_msgTypes[20]
+		mi := &file_linkedca_provisioners_proto_msgTypes[21]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1869,7 +1959,7 @@ func (x *BasicAuth) String() string {
 func (*BasicAuth) ProtoMessage() {}
 
 func (x *BasicAuth) ProtoReflect() protoreflect.Message {
-	mi := &file_linkedca_provisioners_proto_msgTypes[20]
+	mi := &file_linkedca_provisioners_proto_msgTypes[21]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1882,7 +1972,7 @@ func (x *BasicAuth) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use BasicAuth.ProtoReflect.Descriptor instead.
 func (*BasicAuth) Descriptor() ([]byte, []int) {
-	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{20}
+	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *BasicAuth) GetUsername() string {
@@ -1910,7 +2000,7 @@ type BearerToken struct {
 func (x *BearerToken) Reset() {
 	*x = BearerToken{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_linkedca_provisioners_proto_msgTypes[21]
+		mi := &file_linkedca_provisioners_proto_msgTypes[22]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1923,7 +2013,7 @@ func (x *BearerToken) String() string {
 func (*BearerToken) ProtoMessage() {}
 
 func (x *BearerToken) ProtoReflect() protoreflect.Message {
-	mi := &file_linkedca_provisioners_proto_msgTypes[21]
+	mi := &file_linkedca_provisioners_proto_msgTypes[22]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1936,7 +2026,7 @@ func (x *BearerToken) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use BearerToken.ProtoReflect.Descriptor instead.
 func (*BearerToken) Descriptor() ([]byte, []int) {
-	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{21}
+	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *BearerToken) GetBearerToken() string {
@@ -1968,7 +2058,7 @@ type Webhook struct {
 func (x *Webhook) Reset() {
 	*x = Webhook{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_linkedca_provisioners_proto_msgTypes[22]
+		mi := &file_linkedca_provisioners_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1981,7 +2071,7 @@ func (x *Webhook) String() string {
 func (*Webhook) ProtoMessage() {}
 
 func (x *Webhook) ProtoReflect() protoreflect.Message {
-	mi := &file_linkedca_provisioners_proto_msgTypes[22]
+	mi := &file_linkedca_provisioners_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1994,7 +2084,7 @@ func (x *Webhook) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Webhook.ProtoReflect.Descriptor instead.
 func (*Webhook) Descriptor() ([]byte, []int) {
-	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{22}
+	return file_linkedca_provisioners_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *Webhook) GetName() string {
@@ -2334,66 +2424,82 @@ var file_linkedca_provisioners_proto_rawDesc = []byte{
 	0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18,
 	0x01, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
 	0x73, 0x22, 0x13, 0x0a, 0x11, 0x53, 0x53, 0x48, 0x50, 0x4f, 0x50, 0x50, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x22, 0x94, 0x02, 0x0a, 0x0f, 0x53, 0x43, 0x45, 0x50, 0x50,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x12, 0x19, 0x0a, 0x08, 0x66, 0x6f,
-	0x72, 0x63, 0x65, 0x5f, 0x63, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x66, 0x6f,
-	0x72, 0x63, 0x65, 0x43, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e,
-	0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65,
-	0x6e, 0x67, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74,
-	0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62,
-	0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x39, 0x0a, 0x19, 0x6d, 0x69, 0x6e, 0x69, 0x6d,
-	0x75, 0x6d, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x6c, 0x65,
-	0x6e, 0x67, 0x74, 0x68, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x16, 0x6d, 0x69, 0x6e, 0x69,
-	0x6d, 0x75, 0x6d, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x4c, 0x65, 0x6e, 0x67,
-	0x74, 0x68, 0x12, 0x21, 0x0a, 0x0c, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x5f, 0x72, 0x6f,
-	0x6f, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64,
-	0x65, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x46, 0x0a, 0x1f, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x5f, 0x69, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52, 0x1d,
-	0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69,
-	0x74, 0x68, 0x6d, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x22, 0x29, 0x0a,
-	0x11, 0x4e, 0x65, 0x62, 0x75, 0x6c, 0x61, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x72, 0x6f, 0x6f, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x0c, 0x52, 0x05, 0x72, 0x6f, 0x6f, 0x74, 0x73, 0x22, 0x43, 0x0a, 0x09, 0x42, 0x61, 0x73, 0x69,
-	0x63, 0x41, 0x75, 0x74, 0x68, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x30, 0x0a,
-	0x0b, 0x42, 0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x21, 0x0a, 0x0c,
-	0x62, 0x65, 0x61, 0x72, 0x65, 0x72, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0b, 0x62, 0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22,
-	0xdd, 0x03, 0x0a, 0x07, 0x57, 0x65, 0x62, 0x68, 0x6f, 0x6f, 0x6b, 0x12, 0x12, 0x0a, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72,
-	0x6c, 0x12, 0x2a, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x16, 0x2e, 0x6c, 0x69, 0x6e, 0x6b, 0x65, 0x64, 0x63, 0x61, 0x2e, 0x57, 0x65, 0x62, 0x68, 0x6f,
-	0x6f, 0x6b, 0x2e, 0x4b, 0x69, 0x6e, 0x64, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x16, 0x0a,
-	0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73,
-	0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x3a, 0x0a, 0x0c, 0x62, 0x65, 0x61, 0x72, 0x65, 0x72, 0x5f,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6c, 0x69,
-	0x6e, 0x6b, 0x65, 0x64, 0x63, 0x61, 0x2e, 0x42, 0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x48, 0x00, 0x52, 0x0b, 0x62, 0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x12, 0x34, 0x0a, 0x0a, 0x62, 0x61, 0x73, 0x69, 0x63, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x6c, 0x69, 0x6e, 0x6b, 0x65, 0x64, 0x63, 0x61,
-	0x2e, 0x42, 0x61, 0x73, 0x69, 0x63, 0x41, 0x75, 0x74, 0x68, 0x48, 0x00, 0x52, 0x09, 0x62, 0x61,
-	0x73, 0x69, 0x63, 0x41, 0x75, 0x74, 0x68, 0x12, 0x35, 0x0a, 0x17, 0x64, 0x69, 0x73, 0x61, 0x62,
-	0x6c, 0x65, 0x5f, 0x74, 0x6c, 0x73, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x61, 0x75,
-	0x74, 0x68, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x54, 0x6c, 0x73, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x41, 0x75, 0x74, 0x68, 0x12, 0x37,
-	0x0a, 0x09, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x1a, 0x2e, 0x6c, 0x69, 0x6e, 0x6b, 0x65, 0x64, 0x63, 0x61, 0x2e, 0x57, 0x65, 0x62,
-	0x68, 0x6f, 0x6f, 0x6b, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x54, 0x79, 0x70, 0x65, 0x52, 0x08, 0x63,
-	0x65, 0x72, 0x74, 0x54, 0x79, 0x70, 0x65, 0x22, 0x46, 0x0a, 0x04, 0x4b, 0x69, 0x6e, 0x64, 0x12,
-	0x0b, 0x0a, 0x07, 0x4e, 0x4f, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09,
-	0x45, 0x4e, 0x52, 0x49, 0x43, 0x48, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x0f, 0x0a, 0x0b, 0x41,
-	0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x5a, 0x49, 0x4e, 0x47, 0x10, 0x02, 0x12, 0x11, 0x0a, 0x0d,
-	0x53, 0x43, 0x45, 0x50, 0x43, 0x48, 0x41, 0x4c, 0x4c, 0x45, 0x4e, 0x47, 0x45, 0x10, 0x03, 0x22,
-	0x26, 0x0a, 0x08, 0x43, 0x65, 0x72, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x07, 0x0a, 0x03, 0x41,
-	0x4c, 0x4c, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x58, 0x35, 0x30, 0x39, 0x10, 0x01, 0x12, 0x07,
-	0x0a, 0x03, 0x53, 0x53, 0x48, 0x10, 0x02, 0x42, 0x06, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x42,
-	0x15, 0x5a, 0x13, 0x67, 0x6f, 0x2e, 0x73, 0x74, 0x65, 0x70, 0x2e, 0x73, 0x6d, 0x2f, 0x6c, 0x69,
-	0x6e, 0x6b, 0x65, 0x64, 0x63, 0x61, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x22, 0x7f, 0x0a, 0x0d, 0x53, 0x43, 0x45, 0x50, 0x44, 0x65,
+	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x72, 0x12, 0x20, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x63, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x17, 0x0a, 0x07, 0x6b,
+	0x65, 0x79, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6b, 0x65,
+	0x79, 0x55, 0x72, 0x69, 0x12, 0x21, 0x0a, 0x0c, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x6b, 0x65, 0x79, 0x50,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0xfe, 0x02, 0x0a, 0x0f, 0x53, 0x43, 0x45, 0x50,
+	0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x12, 0x19, 0x0a, 0x08, 0x66,
+	0x6f, 0x72, 0x63, 0x65, 0x5f, 0x63, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x66,
+	0x6f, 0x72, 0x63, 0x65, 0x43, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65,
+	0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x68, 0x61, 0x6c, 0x6c,
+	0x65, 0x6e, 0x67, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69,
+	0x74, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x61, 0x70, 0x61,
+	0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x39, 0x0a, 0x19, 0x6d, 0x69, 0x6e, 0x69,
+	0x6d, 0x75, 0x6d, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x6c,
+	0x65, 0x6e, 0x67, 0x74, 0x68, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x16, 0x6d, 0x69, 0x6e,
+	0x69, 0x6d, 0x75, 0x6d, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x4c, 0x65, 0x6e,
+	0x67, 0x74, 0x68, 0x12, 0x21, 0x0a, 0x0c, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x5f, 0x72,
+	0x6f, 0x6f, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x6e, 0x63, 0x6c, 0x75,
+	0x64, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x46, 0x0a, 0x1f, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x5f, 0x69,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52,
+	0x1d, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x6c, 0x67, 0x6f, 0x72,
+	0x69, 0x74, 0x68, 0x6d, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x35,
+	0x0a, 0x09, 0x64, 0x65, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x6c, 0x69, 0x6e, 0x6b, 0x65, 0x64, 0x63, 0x61, 0x2e, 0x53, 0x43, 0x45,
+	0x50, 0x44, 0x65, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x72, 0x52, 0x09, 0x64, 0x65, 0x63, 0x72,
+	0x79, 0x70, 0x74, 0x65, 0x72, 0x12, 0x31, 0x0a, 0x14, 0x65, 0x78, 0x63, 0x6c, 0x75, 0x64, 0x65,
+	0x5f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x74, 0x65, 0x18, 0x08, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x13, 0x65, 0x78, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x49, 0x6e, 0x74, 0x65,
+	0x72, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x74, 0x65, 0x22, 0x29, 0x0a, 0x11, 0x4e, 0x65, 0x62, 0x75,
+	0x6c, 0x61, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x12, 0x14, 0x0a,
+	0x05, 0x72, 0x6f, 0x6f, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x05, 0x72, 0x6f,
+	0x6f, 0x74, 0x73, 0x22, 0x43, 0x0a, 0x09, 0x42, 0x61, 0x73, 0x69, 0x63, 0x41, 0x75, 0x74, 0x68,
+	0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08,
+	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x30, 0x0a, 0x0b, 0x42, 0x65, 0x61, 0x72,
+	0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x62, 0x65, 0x61, 0x72, 0x65,
+	0x72, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x62,
+	0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xec, 0x03, 0x0a, 0x07, 0x57,
+	0x65, 0x62, 0x68, 0x6f, 0x6f, 0x6b, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72,
+	0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x2a, 0x0a, 0x04,
+	0x6b, 0x69, 0x6e, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x6c, 0x69, 0x6e,
+	0x6b, 0x65, 0x64, 0x63, 0x61, 0x2e, 0x57, 0x65, 0x62, 0x68, 0x6f, 0x6f, 0x6b, 0x2e, 0x4b, 0x69,
+	0x6e, 0x64, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72,
+	0x65, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74,
+	0x12, 0x3a, 0x0a, 0x0c, 0x62, 0x65, 0x61, 0x72, 0x65, 0x72, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6c, 0x69, 0x6e, 0x6b, 0x65, 0x64, 0x63,
+	0x61, 0x2e, 0x42, 0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x48, 0x00, 0x52,
+	0x0b, 0x62, 0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x34, 0x0a, 0x0a,
+	0x62, 0x61, 0x73, 0x69, 0x63, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x13, 0x2e, 0x6c, 0x69, 0x6e, 0x6b, 0x65, 0x64, 0x63, 0x61, 0x2e, 0x42, 0x61, 0x73, 0x69,
+	0x63, 0x41, 0x75, 0x74, 0x68, 0x48, 0x00, 0x52, 0x09, 0x62, 0x61, 0x73, 0x69, 0x63, 0x41, 0x75,
+	0x74, 0x68, 0x12, 0x35, 0x0a, 0x17, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x74, 0x6c,
+	0x73, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18, 0x08, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x14, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x54, 0x6c, 0x73, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x41, 0x75, 0x74, 0x68, 0x12, 0x37, 0x0a, 0x09, 0x63, 0x65, 0x72,
+	0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6c,
+	0x69, 0x6e, 0x6b, 0x65, 0x64, 0x63, 0x61, 0x2e, 0x57, 0x65, 0x62, 0x68, 0x6f, 0x6f, 0x6b, 0x2e,
+	0x43, 0x65, 0x72, 0x74, 0x54, 0x79, 0x70, 0x65, 0x52, 0x08, 0x63, 0x65, 0x72, 0x74, 0x54, 0x79,
+	0x70, 0x65, 0x22, 0x55, 0x0a, 0x04, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x0b, 0x0a, 0x07, 0x4e, 0x4f,
+	0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x45, 0x4e, 0x52, 0x49, 0x43,
+	0x48, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x0f, 0x0a, 0x0b, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52,
+	0x49, 0x5a, 0x49, 0x4e, 0x47, 0x10, 0x02, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x43, 0x45, 0x50, 0x43,
+	0x48, 0x41, 0x4c, 0x4c, 0x45, 0x4e, 0x47, 0x45, 0x10, 0x03, 0x12, 0x0d, 0x0a, 0x09, 0x4e, 0x4f,
+	0x54, 0x49, 0x46, 0x59, 0x49, 0x4e, 0x47, 0x10, 0x04, 0x22, 0x26, 0x0a, 0x08, 0x43, 0x65, 0x72,
+	0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x07, 0x0a, 0x03, 0x41, 0x4c, 0x4c, 0x10, 0x00, 0x12, 0x08,
+	0x0a, 0x04, 0x58, 0x35, 0x30, 0x39, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x53, 0x53, 0x48, 0x10,
+	0x02, 0x42, 0x06, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x42, 0x15, 0x5a, 0x13, 0x67, 0x6f, 0x2e,
+	0x73, 0x74, 0x65, 0x70, 0x2e, 0x73, 0x6d, 0x2f, 0x6c, 0x69, 0x6e, 0x6b, 0x65, 0x64, 0x63, 0x61,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -2409,7 +2515,7 @@ func file_linkedca_provisioners_proto_rawDescGZIP() []byte {
 }
 
 var file_linkedca_provisioners_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
-var file_linkedca_provisioners_proto_msgTypes = make([]protoimpl.MessageInfo, 23)
+var file_linkedca_provisioners_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_linkedca_provisioners_proto_goTypes = []interface{}{
 	(Provisioner_Type)(0),                      // 0: linkedca.Provisioner.Type
 	(ACMEProvisioner_ChallengeType)(0),         // 1: linkedca.ACMEProvisioner.ChallengeType
@@ -2434,13 +2540,14 @@ var file_linkedca_provisioners_proto_goTypes = []interface{}{
 	(*X5CProvisioner)(nil),                     // 20: linkedca.X5CProvisioner
 	(*K8SSAProvisioner)(nil),                   // 21: linkedca.K8sSAProvisioner
 	(*SSHPOPProvisioner)(nil),                  // 22: linkedca.SSHPOPProvisioner
-	(*SCEPProvisioner)(nil),                    // 23: linkedca.SCEPProvisioner
-	(*NebulaProvisioner)(nil),                  // 24: linkedca.NebulaProvisioner
-	(*BasicAuth)(nil),                          // 25: linkedca.BasicAuth
-	(*BearerToken)(nil),                        // 26: linkedca.BearerToken
-	(*Webhook)(nil),                            // 27: linkedca.Webhook
-	(*timestamppb.Timestamp)(nil),              // 28: google.protobuf.Timestamp
-	(*Policy)(nil),                             // 29: linkedca.Policy
+	(*SCEPDecrypter)(nil),                      // 23: linkedca.SCEPDecrypter
+	(*SCEPProvisioner)(nil),                    // 24: linkedca.SCEPProvisioner
+	(*NebulaProvisioner)(nil),                  // 25: linkedca.NebulaProvisioner
+	(*BasicAuth)(nil),                          // 26: linkedca.BasicAuth
+	(*BearerToken)(nil),                        // 27: linkedca.BearerToken
+	(*Webhook)(nil),                            // 28: linkedca.Webhook
+	(*timestamppb.Timestamp)(nil),              // 29: google.protobuf.Timestamp
+	(*Policy)(nil),                             // 30: linkedca.Policy
 }
 var file_linkedca_provisioners_proto_depIdxs = []int32{
 	0,  // 0: linkedca.Provisioner.type:type_name -> linkedca.Provisioner.Type
@@ -2448,10 +2555,10 @@ var file_linkedca_provisioners_proto_depIdxs = []int32{
 	9,  // 2: linkedca.Provisioner.claims:type_name -> linkedca.Claims
 	13, // 3: linkedca.Provisioner.x509_template:type_name -> linkedca.Template
 	13, // 4: linkedca.Provisioner.ssh_template:type_name -> linkedca.Template
-	28, // 5: linkedca.Provisioner.created_at:type_name -> google.protobuf.Timestamp
-	28, // 6: linkedca.Provisioner.deleted_at:type_name -> google.protobuf.Timestamp
-	29, // 7: linkedca.Provisioner.policy:type_name -> linkedca.Policy
-	27, // 8: linkedca.Provisioner.webhooks:type_name -> linkedca.Webhook
+	29, // 5: linkedca.Provisioner.created_at:type_name -> google.protobuf.Timestamp
+	29, // 6: linkedca.Provisioner.deleted_at:type_name -> google.protobuf.Timestamp
+	30, // 7: linkedca.Provisioner.policy:type_name -> linkedca.Policy
+	28, // 8: linkedca.Provisioner.webhooks:type_name -> linkedca.Webhook
 	0,  // 9: linkedca.ProvisionerIdentity.type:type_name -> linkedca.Provisioner.Type
 	14, // 10: linkedca.ProvisionerDetails.JWK:type_name -> linkedca.JWKProvisioner
 	15, // 11: linkedca.ProvisionerDetails.OIDC:type_name -> linkedca.OIDCProvisioner
@@ -2462,8 +2569,8 @@ var file_linkedca_provisioners_proto_depIdxs = []int32{
 	20, // 16: linkedca.ProvisionerDetails.X5C:type_name -> linkedca.X5CProvisioner
 	21, // 17: linkedca.ProvisionerDetails.K8sSA:type_name -> linkedca.K8sSAProvisioner
 	22, // 18: linkedca.ProvisionerDetails.SSHPOP:type_name -> linkedca.SSHPOPProvisioner
-	23, // 19: linkedca.ProvisionerDetails.SCEP:type_name -> linkedca.SCEPProvisioner
-	24, // 20: linkedca.ProvisionerDetails.Nebula:type_name -> linkedca.NebulaProvisioner
+	24, // 19: linkedca.ProvisionerDetails.SCEP:type_name -> linkedca.SCEPProvisioner
+	25, // 20: linkedca.ProvisionerDetails.Nebula:type_name -> linkedca.NebulaProvisioner
 	5,  // 21: linkedca.ProvisionerList.provisioners:type_name -> linkedca.Provisioner
 	10, // 22: linkedca.Claims.x509:type_name -> linkedca.X509Claims
 	11, // 23: linkedca.Claims.ssh:type_name -> linkedca.SSHClaims
@@ -2472,15 +2579,16 @@ var file_linkedca_provisioners_proto_depIdxs = []int32{
 	12, // 26: linkedca.SSHClaims.host_durations:type_name -> linkedca.Durations
 	1,  // 27: linkedca.ACMEProvisioner.challenges:type_name -> linkedca.ACMEProvisioner.ChallengeType
 	2,  // 28: linkedca.ACMEProvisioner.attestation_formats:type_name -> linkedca.ACMEProvisioner.AttestationFormatType
-	3,  // 29: linkedca.Webhook.kind:type_name -> linkedca.Webhook.Kind
-	26, // 30: linkedca.Webhook.bearer_token:type_name -> linkedca.BearerToken
-	25, // 31: linkedca.Webhook.basic_auth:type_name -> linkedca.BasicAuth
-	4,  // 32: linkedca.Webhook.cert_type:type_name -> linkedca.Webhook.CertType
-	33, // [33:33] is the sub-list for method output_type
-	33, // [33:33] is the sub-list for method input_type
-	33, // [33:33] is the sub-list for extension type_name
-	33, // [33:33] is the sub-list for extension extendee
-	0,  // [0:33] is the sub-list for field type_name
+	23, // 29: linkedca.SCEPProvisioner.decrypter:type_name -> linkedca.SCEPDecrypter
+	3,  // 30: linkedca.Webhook.kind:type_name -> linkedca.Webhook.Kind
+	27, // 31: linkedca.Webhook.bearer_token:type_name -> linkedca.BearerToken
+	26, // 32: linkedca.Webhook.basic_auth:type_name -> linkedca.BasicAuth
+	4,  // 33: linkedca.Webhook.cert_type:type_name -> linkedca.Webhook.CertType
+	34, // [34:34] is the sub-list for method output_type
+	34, // [34:34] is the sub-list for method input_type
+	34, // [34:34] is the sub-list for extension type_name
+	34, // [34:34] is the sub-list for extension extendee
+	0,  // [0:34] is the sub-list for field type_name
 }
 
 func init() { file_linkedca_provisioners_proto_init() }
@@ -2707,7 +2815,7 @@ func file_linkedca_provisioners_proto_init() {
 			}
 		}
 		file_linkedca_provisioners_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SCEPProvisioner); i {
+			switch v := v.(*SCEPDecrypter); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2719,7 +2827,7 @@ func file_linkedca_provisioners_proto_init() {
 			}
 		}
 		file_linkedca_provisioners_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NebulaProvisioner); i {
+			switch v := v.(*SCEPProvisioner); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2731,7 +2839,7 @@ func file_linkedca_provisioners_proto_init() {
 			}
 		}
 		file_linkedca_provisioners_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*BasicAuth); i {
+			switch v := v.(*NebulaProvisioner); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2743,7 +2851,7 @@ func file_linkedca_provisioners_proto_init() {
 			}
 		}
 		file_linkedca_provisioners_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*BearerToken); i {
+			switch v := v.(*BasicAuth); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2755,6 +2863,18 @@ func file_linkedca_provisioners_proto_init() {
 			}
 		}
 		file_linkedca_provisioners_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BearerToken); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_linkedca_provisioners_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Webhook); i {
 			case 0:
 				return &v.state
@@ -2780,7 +2900,7 @@ func file_linkedca_provisioners_proto_init() {
 		(*ProvisionerDetails_SCEP)(nil),
 		(*ProvisionerDetails_Nebula)(nil),
 	}
-	file_linkedca_provisioners_proto_msgTypes[22].OneofWrappers = []interface{}{
+	file_linkedca_provisioners_proto_msgTypes[23].OneofWrappers = []interface{}{
 		(*Webhook_BearerToken)(nil),
 		(*Webhook_BasicAuth)(nil),
 	}
@@ -2790,7 +2910,7 @@ func file_linkedca_provisioners_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_linkedca_provisioners_proto_rawDesc,
 			NumEnums:      5,
-			NumMessages:   23,
+			NumMessages:   24,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/spec/linkedca/provisioners.proto b/spec/linkedca/provisioners.proto
index 31abc3a..feb8e31 100644
--- a/spec/linkedca/provisioners.proto
+++ b/spec/linkedca/provisioners.proto
@@ -168,6 +168,13 @@ message K8sSAProvisioner {
 
 message SSHPOPProvisioner {}
 
+message SCEPDecrypter {
+	bytes certificate = 1;
+	bytes key = 2;
+	string key_uri = 3;
+	bytes key_password = 4;
+}
+
 message SCEPProvisioner {
 	bool force_cn = 1;
 	string challenge = 2;
@@ -175,6 +182,8 @@ message SCEPProvisioner {
 	int32 minimum_public_key_length = 4;
 	bool include_root = 5;
 	int32 encryption_algorithm_identifier = 6;
+	SCEPDecrypter decrypter = 7;
+	bool exclude_intermediate = 8;
 }
 
 message NebulaProvisioner {
@@ -196,6 +205,7 @@ message Webhook {
 		ENRICHING = 1;
 		AUTHORIZING = 2;
 		SCEPCHALLENGE = 3;
+		NOTIFYING = 4;
 	}
 	enum CertType {
 		ALL = 0;