MDM and Credentials Payloads

I'm successfully enrolling and configuring devices for VPN access using OTA profile delivery, but I need to add MDM and Credentials payloads to enable automatic profile updates in the case of VPN connection failure. The iPhone Configuration Utility documentation explains the Identity setting of the MDM payload refers to the certificate the device uses to identify itself to the server, and can be can be provided using the Credentials payload, or by using SCEP. I have an installation of EJBCA running which provides support of SCEP, but I've found that without the Credentials payload, I get an error that the identity certificate cannot be found.

My issue is that my CA server creates random passwords for the certificates it generates, and I don't yet know how to get access to them. If I provide a blank password value, the profile fails to install because the password is incorrect. If I don't include the password key at all, the user is prompted. I've also tried to use my MDM server certificate as the credential, for which I know the password, but that also fails with the same incorrect password error.

Does anyone have some experience in this area who could confirm my understanding of how the MDM and credentials payloads are supposed to work or have any idea how I might get around this issue.

Thanks in advance.

Rob