I am facing issue in encrypting the final configuration profile to be sent to the iOS device(Phase 3). 

I am using the Bouncy castle library to encrypt my final profile(<http://elian.co.uk/post/2009/07/29/Bouncy-Castle-CSharp.aspx>).

**Questions:** 

1. Which certificate should I use for encrypting the profile,
Is it a CA or Server certificate created or Certificate returned after Phase 2(SCEP)?

A code sample would be very helpful.

**NOTE:** The profile is getting installed successfully without encryption or even if I sign the profile.