When using SCEP in RA mode, many normal issues that are handled graceuflly are logged with log.error, which is too high. For example if the request does not fulfill the end entity profile.
This is something that can be expected and should only be logged at INFO level, or max warn.
Also to the client HTTP 501 (not implemented) is returned, which is wrong. BAD_REQUEST is more matching, albeit it's not perfect for all error conditions that can occur in ScepRaModeExtension.