diff --git a/mdm/enroll/service.go b/mdm/enroll/service.go
index 920fd221..01051c6c 100644
--- a/mdm/enroll/service.go
+++ b/mdm/enroll/service.go
@@ -29,18 +29,10 @@ type Service interface {
 	OTAPhase3(ctx context.Context) (profile.Mobileconfig, error)
 }
 
-func NewService(topic TopicProvider, sub pubsub.Subscriber, caCertPath, scepURL, scepChallenge, url, tlsCertPath, scepSubject string, profileDB profile.Store) (Service, error) {
-	var caCert, tlsCert []byte
+func NewService(topic TopicProvider, sub pubsub.Subscriber, scepURL, scepChallenge, url, tlsCertPath, scepSubject string, profileDB profile.Store) (Service, error) {
+	var tlsCert []byte
 	var err error
 
-	if caCertPath != "" {
-		caCert, err = ioutil.ReadFile(caCertPath)
-
-		if err != nil {
-			return nil, err
-		}
-	}
-
 	if tlsCertPath != "" {
 		tlsCert, err = ioutil.ReadFile(tlsCertPath)
 
@@ -72,7 +64,6 @@ func NewService(topic TopicProvider, sub pubsub.Subscriber, caCertPath, scepURL,
 		SCEPURL:       scepURL,
 		SCEPSubject:   subject,
 		SCEPChallenge: scepChallenge,
-		CACert:        caCert,
 		TLSCert:       tlsCert,
 		ProfileDB:     profileDB,
 		Topic:         pushTopic,
@@ -118,7 +109,6 @@ type service struct {
 	SCEPURL       string
 	SCEPChallenge string
 	SCEPSubject   [][][]string
-	CACert        []byte
 	TLSCert       []byte
 	ProfileDB     profile.Store
 
@@ -232,16 +222,6 @@ func (svc *service) MakeEnrollmentProfile() (Profile, error) {
 
 	payloadContent = append(payloadContent, mdmPayloadContent)
 
-	if len(svc.CACert) > 0 {
-		caPayload := NewPayload("com.apple.security.root")
-		caPayload.PayloadDisplayName = "Root certificate for MicroMDM"
-		caPayload.PayloadDescription = "Installs the root CA certificate for MicroMDM"
-		caPayload.PayloadIdentifier = EnrollmentProfileId + ".cert.ca"
-		caPayload.PayloadContent = svc.CACert
-
-		payloadContent = append(payloadContent, *caPayload)
-	}
-
 	// Client needs to trust us at this point if we are using a self signed certificate.
 	if len(svc.TLSCert) > 0 {
 		tlsPayload := NewPayload("com.apple.security.pem")
diff --git a/server/server.go b/server/server.go
index b377cc4d..69441413 100644
--- a/server/server.go
+++ b/server/server.go
@@ -60,11 +60,6 @@ type Server struct {
 	CommandWebhookURL   string
 	DEPClient           dep.Client
 
-	// TODO: refactor enroll service and remove the need to reference
-	// this on-disk cert. but it might be useful to keep the PEM
-	// around for anyone who will need to export the CA.
-	SCEPCACertPath string
-
 	PushService     *push.Service // bufford push
 	APNSPushService apns.Service
 	CommandService  command.Service
@@ -335,7 +330,6 @@ func (c *Server) setupEnrollmentService() error {
 	c.EnrollService, err = enroll.NewService(
 		topicProvider,
 		c.PubClient,
-		c.SCEPCACertPath,
 		c.ServerPublicURL+"/scep",
 		c.SCEPChallenge,
 		c.ServerPublicURL,
@@ -432,14 +426,7 @@ func (c *Server) setupSCEP(logger log.Logger) error {
 		return err
 	}
 
-	caCert, err := depot.CreateOrLoadCA(key, 5, "MicroMDM", "US")
-	if err != nil {
-		return err
-	}
-
-	c.SCEPCACertPath = filepath.Join(c.ConfigPath, "SCEPCACert.pem")
-
-	err = crypto.WritePEMCertificateFile(caCert, c.SCEPCACertPath)
+	_, err = depot.CreateOrLoadCA(key, 5, "MicroMDM", "US")
 	if err != nil {
 		return err
 	}