Enroll via pkcs10 request (manual), Enroll via scep at [name of scep ca, Install a new sa using scep before enrolling – Cisco VPN 3002 User Manual
Page 164: Go back and choose a different type of certificate, Administration | certificate management | enroll