def build_scep_payload(enrollment_session):
    subject = [[["CN", enrollment_session.get_common_name()]]]
    serial_number = enrollment_session.get_serial_number()
    if serial_number:
        subject.append([["2.5.4.5", serial_number]])
    subject.append([["O", enrollment_session.get_organization()]])
    return build_payload("com.apple.security.scep",
                         enrollment_session.get_payload_name(),
                         "scep",
                         {"URL": "{}/scep".format(settings["api"]["tls_hostname"]),  # TODO: hardcoded scep url
                          "Subject": subject,
                          "Challenge": enrollment_session.get_challenge(),
                          "Keysize": 2048,
                          "KeyType": "RSA",
                          "Key Usage": 5,  # 1 is signing, 4 is encryption, 5 is both signing and encryption
                          },
                         encapsulate_content=True)