diff --git a/.github/scripts/test_sscep.sh b/.github/scripts/test_sscep.sh
new file mode 100755
index 00000000..6040366f
--- /dev/null
+++ b/.github/scripts/test_sscep.sh
@@ -0,0 +1,83 @@
+#!/bin/bash
+# test_sscep.sh
+#
+# Copyright (C) 2006-2025 wolfSSL Inc.
+#
+# This file is part of wolfProvider.
+#
+# wolfProvider is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# wolfProvider is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+TEST_SSCEP_FAIL=0
+
+cleanup(){
+    [ -f ca.crt     ] && rm -f  ca.crt
+    [ -d ca-dir     ] && rm -rf ca-dir
+}
+
+killall scepserver &> /dev/null
+cleanup
+
+# begin by setting up and starting the scep server
+OPENSSL_CONF="" OPENSSL_MODULES="" scepserver ca -depot ca-dir -init
+OPENSSL_CONF="" OPENSSL_MODULES="" scepserver -depot ca-dir -port 8080 -debug &
+
+sleep 1
+
+# now test sscep
+
+# getca
+sscep getca -u "http://localhost:8080/scep" -c ca.crt -v -d
+
+if [ $? -eq 0 ] && [ -f ca.crt ] \
+    && diff -y ca.crt ca-dir/ca.pem
+then
+    echo "[ PASSED ] getca"
+else
+    echo "[ FAILED ] getca"
+    TEST_SSCEP_FAIL=1
+fi
+
+# getnextca
+# could not get certificate chaining to work. Not sure if it's the servers fault
+#   or mine.
+
+# enroll
+# first generate ca request (sscep has a script for this)
+timeout 10 ./mkrequest -ip 1.2.3.4
+
+if [ $? -eq 0 ]; then
+    # then enroll -> sscep WILL fail this.
+    # scepserver uses des-cbc (which is not supported) when sending a cert back, so
+    #   to test just check that the .csr got over to the server. This way at least
+    #   some of its functionality can be tested
+    sscep enroll -u "http://localhost:8080/scep" -c ca.crt -k local.key -r local.csr -l local.crt -v -d
+
+    if [ -f ca-dir/1.2.3.4*.pem ];
+    then
+        echo "[ PASSED ] enroll"
+    else
+        echo "[ FAILED ] enroll"
+        TEST_SSCEP_FAIL=1
+    fi
+else
+    echo "[ FAILED ] enroll"
+    TEST_SSCEP_FAIL=1
+fi
+
+killall scepserver &> /dev/null
+
+cleanup
+
+$GITHUB_WORKSPACE/.github/scripts/check-workflow-result.sh $TEST_SSCEP_FAIL "$WOLFPROV_FORCE_FAIL_STR" sscep
+exit $?
diff --git a/.github/workflows/sscep.yml b/.github/workflows/sscep.yml
new file mode 100644
index 00000000..924e72ea
--- /dev/null
+++ b/.github/workflows/sscep.yml
@@ -0,0 +1,90 @@
+name: sscep Tests
+
+# START OF COMMON SECTION
+on:
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  pull_request:
+    branches: [ '*' ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+# END OF COMMON SECTION
+
+jobs:
+  build_wolfprovider:
+    uses: ./.github/workflows/build-wolfprovider.yml
+    with:
+      wolfssl_ref: ${{ matrix.wolfssl_ref }}
+      openssl_ref: ${{ matrix.openssl_ref }}
+    strategy:
+      matrix:
+        wolfssl_ref: [ 'master', 'v5.8.0-stable' ]
+        openssl_ref: [ 'openssl-3.5.0' ]
+
+  test_sscep:
+    runs-on: ubuntu-22.04
+    needs: build_wolfprovider
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        sscep_ref: [ 'master', 'v0.10.0' ]
+        wolfssl_ref: [ 'master', 'v5.8.0-stable' ]
+        openssl_ref: [ 'openssl-3.5.0' ]
+        force_fail: [ 'WOLFPROV_FORCE_FAIL=1', '' ]
+
+    steps:
+      - name: Checkout wolfProvider
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Retrieving wolfSSL/wolfProvider from cache
+        uses: actions/cache/restore@v4
+        id: wolfprov-cache
+        with:
+          path: |
+            wolfssl-install
+            wolfprov-install
+            openssl-install/lib64
+            openssl-install/include
+            openssl-install/bin
+
+          key: wolfprov-${{ matrix.wolfssl_ref }}-${{ matrix.openssl_ref }}-${{ github.sha }}
+          fail-on-cache-miss: true
+
+      - name: Install sscep dependencies
+        run: |
+          sudo apt-get update
+
+          sudo apt-get install -y scep psmisc
+
+      - name: Download sscep
+        uses: actions/checkout@v4
+        with:
+          repository: certnanny/sscep
+          ref: ${{ matrix.sscep_ref }}
+          path: sscep
+
+      - name: Build sscep
+        working-directory: sscep
+        run: |
+          # force sscep to use the openssl binary in wolfProvider
+          sudo ln -sf $GITHUB_WORKSPACE/openssl-install/bin/openssl /usr/bin/openssl
+
+          export openssl_CFLAGS="-I$GITHUB_WORKSPACE/openssl-install/include/"
+          export openssl_LIBS="-L$GITHUB_WORKSPACE/openssl-install/lib64 -lssl -lcrypto"
+
+          autoreconf -vfi
+          ./configure
+          make -j $(nproc)
+          sudo make install
+
+      - name: Run sscep tests
+        run: |
+          source $GITHUB_WORKSPACE/scripts/env-setup
+          export ${{ matrix.force_fail }}
+          export WOLFPROV_FORCE_FAIL_STR="${{ matrix.force_fail }}"
+
+          cd sscep && $GITHUB_WORKSPACE/.github/scripts/test_sscep.sh