FortiGate Certificate enrollment using SCEP with elliptic curve

[FabianC]

Dear all,
A question about how FortiGate handles the communication with a SCEP server when the CSR is based on elliptic curve.

As stated in this FortiGate article [1], a CSR based on elliptic curve can be sent to a SCEP server.

In that case, and as specified in the SCEP rfc8894 [2]:
"The form of encryption to be applied depends on the capabilities of the recipient's public key. If the key is encryption capable (for example, RSA), then the messageData is encrypted using the recipient's public key with the CMS KeyTransRecipientInfo mechanism. If the key is not encryption capable (for example, DSA or ECDSA), then the messageData is encrypted using the challengePassword with the CMS PasswordRecipientInfo mechanism. "

That further says: "Note that some early implementations of this specification dealt with keys that were not encryption capable by omitting the encryption stage, based on the text in Section 3 that indicated that "the EnvelopedData is omitted"

My question: when emitting a CSR based on elliptic curve, does FortiGate handle the returned value of a certPoll operation properly, using the challengePassword with the CMS PasswordRecipientInfo mechanism ?

Thank you for any answer
Best regards
Fabian

[1] https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Certificate-enrollment-using-SCE...

[2] https://www.rfc-editor.org/rfc/rfc8894.html