Heyho,
for the use of our Scep certificates on Ventura we had to insert the fingerprint of the Root-Ca in the payload. This was not necessary on older MacOS Versions.
We are rolling out the certificates using a mobileconfig which is pushed from an mdm server.