Ok, ended up with just generating scep certificate according to windows mdm manual. Apple MDM Apn cert seems to be not needed in terraform, and can just be managed via UI