I deploy with a MS Enterprise CA "User Certificates" for VPN usage to our Blackberry Devices... But never the certificates will be do a Auto renewal.
I´m not shure, why. I use the SCEP Profile only attached to the VPN Profile on BES, no direct assignment to a Usergroup or something else.
User SCEP certificates Deployment within VPN Profile works fine.
Actually I delete every year the SCEP Parameter into my BES VPN Profile for a Weekend and tell the users they should´nt shutdown their devices a Weekend Long. After Weekend, if all users don´t shutdown her Blackberrys the user certificates was deleted and at monday I enable SCEP Paramter within VPN Profile again..
it´s a Manual Auto renewal Feature with BES 12.4
Maybe you found a solution, pls let me know