When you are experiencing issues with regards to being unable to enrol a mobile device, it is important that you verify the following:
1) The Mobile device can talk with the SCEP server (Ensure there are no network issues)
2) The SCEP Server has been installed/configured correctly
So that you are able to isolate whether the issue is originating from the SCEP server or the Symantec Mobile Management Solution, we recommend that you use the iPhone Configuration Utility to attempt to install a SCEP Payload while bypass the Symantec Mobile Management Solution Implementation.
The attached document provides a basic overview on how to use the iPhone Configuration Utility to verify your SCEP Implementation. Should you be unable to install the SCEP Payload via the iPhone Configuration Utility, it is recommended that you verify that you have installed/configured the SCEP server in a manner that the Symantec Mobile Management Solution Requires.
Please refer to the Microsoft SCEP Implementation Whitepaper to ensure that the SCEP Server has been installed/configured in accordance to Microsoft Best Practises.