The CA on the Primary or Linux Application Server is not used; disable the setting Platform ViewSettingsGeneralCertificatesRenew automatically.
Select an appropriate Certificate Authority that can fulfill the trust and certificate requirement of the deployment, including a SCEP service based on EJBCA.
The steps required to enable SCEP operation are covered in the IP Office Branch documentation.