The "ipsec scepclient" tool has been removed and replaced by the pki subcommands "pki --scep" and "pki --scepca" which implement the new SCEP RFC 8894 standard that was released in September 2020 and which supports trusted "certificate renewal" based on the existing client certificate.