Required software development freelancer for Explain the difference between SCEP and PKS certificate based authentication for per-app VPN job

I'm implementing a per-app VPN (PaloAlto Global Protect) on iOS devices using Intune with certificate-based authentication. Currently, there is a Certificate Authority available as part of the on-prem infrastructure, but no NDES server. As I understand NDES server is required for SCPE cert.

I'm looking for a PKI/certificate specialist who would explain to me all parts of the PKI infrastructure required for this and advise me on the pros and cons when choosing one over the other one (PKS vs SCEP).

Not expecting you to go into the details but need to be able any answers I might have.

Example:
Why does SCEP cert require NDES server?
Does PKS cert require NDES server, if not then why?
Is it possible to create SCEP or PKS cert in some manual way without NDES sever?

Thanks

Skills & Expertise Required

software development