code: public CertStore getCertificate(final X509Certificate identity,
              final PrivateKey key, final BigInteger serial, final String profile)
              throws OperationFailureException, ClientException {
          LOGGER.debug("Retriving certificate from CA");
          // TRANSACTIONAL
          // Certificate query
          final CertStore store = getCaCertificate(profile);
          CertStoreInspector certs = inspectorFactory.getInstance(store);
          final X509Certificate ca = certs.getIssuer();
  
          X500Name name = X500Utils.toX500Name(ca.getSubjectX500Principal());
          IssuerAndSerialNumber iasn = new IssuerAndSerialNumber(name, serial);
          Transport transport = createTransport(profile);
          final Transaction t = new NonEnrollmentTransaction(transport,
                  getEncoder(identity, key, profile), getDecoder(identity, key,
                          profile), iasn, MessageType.GET_CERT);
  
          State state;
          try {
              state = t.send();
          } catch (TransactionException e) {
              throw new ClientException(e);
          }
  
          if (state == State.CERT_ISSUED) {
              return t.getCertStore();
          } else if (state == State.CERT_REQ_PENDING) {
              throw new IllegalStateException();
          } else {
              throw new OperationFailureException(t.getFailInfo());
          }
      }
docs: Retrieves the certificate corresponding to the provided serial number.
  <p>
  This request relates only to the current CA certificate. If the CA
  certificate has changed since the requested certificate was issued, this
  operation will fail.
  <p>
  This method provides support for SCEP servers with multiple profiles.
  
  @param identity
  the identity of the client.
  @param key
  the private key to sign the SCEP request.
  @param serial
  the serial number of the requested certificate.
  @param profile
  the SCEP server profile.
  @return the certificate store containing the requested certificate.
  @throws ClientException
  if any client error occurs.
  @throws OperationFailureException
  if the SCEP server refuses to service the request.