SCEP payload settings for Apple devices
You can configure SCEP settings to obtain certificates from a certificate authority (CA) for Apple devices enrolled in a mobile device management (MDM) solution. Use the SCEP payload to specify settings that allow the device to obtain certificates from a certificate authority (CA) using the Simple Certificate Enrolment Protocol (SCEP).
OS and channel | Supported enrolment types | Interaction | Duplicates |
|---|---|---|---|
iOS iPadOS tvOS macOS device macOS user | Device Automated Device | Combined | Multiple |
Setting | Description | Required |
|---|---|---|
URL | The address of the SCEP server. | Yes |
Name | Any string understood by the certificate authority. It can be used to distinguish between instances, for example. | No |
Subject | The representation of an X.500 name represented as an array of OID and value. For example, /C=US/O=Apple Inc. /CN=foo/1.2.5.3=bar, which translates to: [ [ [“C”, “US”] ], [ [“O”, “Apple Inc.”] ], ..., [ [ “1.2.5.3”, “bar” ] ] ] | No |
Subject Alternative Name Type | Specify the type of an alternative name for the SCEP server. Types are RFC 822 Name, DNS Name and Uniform Resource Identifier (URI). This can be the Uniform Resource Locator (URL), Uniform Resource Name (URN), or both. | No |
Subject Alternative Name Value | The value of the subject alternative name. | No |
NT Principal Name | The principal name to be used in the certificate request (optional). | No |
Retries | The number of times to poll the SCEP server for a signed certificate before giving up. | No |
Retry Delay | The number of seconds to wait between poll attempts. | No |
Challenge | The pre-shared secret the SCEP server uses to identify the request or user. | No |
Certificate expiry notification threshold (macOS-only) | The number of days in advance before the certificate starts showing an expiry notification. | No |
Key size | Select a key size and — using the tickboxes below this field — the acceptable uses of the key. | No |
Key usage | Select to use the key for any of the following:
| No |
Fingerprint | If your CA uses HTTP, use this field to provide the fingerprint of the CA’s certificate, which the device uses to confirm the authenticity of the CA’s response during enrolment. You can enter a SHA1 or an MD5 fingerprint, or select a certificate to import its signature. | No |
Allow export from the Keychain (macOS-only) | Allow the private key to be exported from the Keychain. | No |
Allow access to all apps (macOS-only) | Allow all apps to access the certificate in keychain. | No |
Variables
With macOS, you can use the following variables in the SCEP Subject and Subject Alternate Name, and NT Principal Name fields. These variables are resolved on the device during installation, letting you dynamically customise the certificate enrolment request. You can combine these variables with static text, such as Mac. %ComputerName%, to create a compound subject.
Consult your MDM vendor’s documentation to learn which variables they support.
Variable | Substitution |
|---|---|
%AD_ComputerID% | Active Directory computer ID |
%AD_Domain% | Active Directory domain |
%AD_DomainForestName% | Active Directory forest name |
%AD_DomainGuid% | Active Directory GUID |
%AD_DomainNameDNS% | Active Directory DNS Name |
%AD_KerberosID% | Active Directory Kerberos ID |
%ComputerName% | The computer’s name, as set in System Preferences > Sharing |
%HardwareUUID% | The computer’s unique identifier |
%HostName% | The computer’s DNS name, such as mac1.example.com |
%LocalHostName% | The computer’s local network name, such as Mac1.local |
%MACAddress% | The computer’s Ethernet (en0) MAC address |
%SerialNumber% | The computer’s serial number |