Hi Jones,
We used SCEP for many other devices already so when implementing this we just used the same certificate template we use for those devices and didn’t follow the guide on this site, looking over it the way this is done is similar to our setup but our CA is on a separate server to the NDES Server.
We went with the web interface and had no issues with it. We do have an issue where the certificates are not auto-renewing, that seems to be a common bug people report, we are yet to figure out why.