code: public CertStore getRolloverCertificate(final String profile)
              throws ClientException {
          LOGGER.debug("Retriving next CA certificate from CA");
          // NON-TRANSACTIONAL
          if (!getCaCapabilities(profile).isRolloverSupported()) {
              throw new UnsupportedOperationException();
          }
          final CertStore store = getCaCertificate(profile);
          // The CA or RA
          CertStoreInspector certs = inspectorFactory.getInstance(store);
          final X509Certificate signer = certs.getSigner();
  
          final Transport trans = transportFactory.forMethod(Method.GET, url);
          final GetNextCaCertRequest req = new GetNextCaCertRequest(profile);
  
          try {
              return trans.sendRequest(req, new GetNextCaCertResponseHandler(
                      signer));
          } catch (TransportException e) {
              throw new ClientException(e);
          }
      }
docs: Retrieves the next certificate to be used by the CA.
  <p>
  This method will query the SCEP server to determine if the CA is
  scheduled to start using a new certificate for issuing.
  <p>
  This method provides support for SCEP servers with multiple profiles.
  
  @param profile
  the SCEP server profile.
  @return the certificate store.
  @throws ClientException
  if any client error occurs.
  @see CertStoreInspector