|
|
While passwords are commonly used for security and authentication purposes, many organizations now prefer using digitally signed certificates to authenticate the users before accessing the Exchange server, Wi-Fi, VPN etc. as it reduces the chances of forgotten passwords and numerous password resets. Mobile Device Manager Plus (MDM) simplifies the creation, distribution and renewal of digitally signed certificates.
There are two types of commonly used certificates:
Admins use a single certificate which can be used to authenticate all the users in the organization. This trust certificate can be used by all the employees to authenticate the device while accessing their Exchange accounts and connecting to the Wi-fi or VPN.
To allow the users to authenticate their devices, the certificate must be present on the device. This can be done by distributing the certificate using MDM.
Organizations integrate with a Certificate Authority (CA) that is responsible for issuing certificates and creates a certificate for every user in the organization. The CA authority when integrated with MDM, creates and distributes individual certificates for all the users accessing their Exchange accounts, Wi-fi or VPN.
MDM allows organizations to manage both trust and user-specific certificates with it's Certificate Management capabilities.
Admins can upload the required certificates on the MDM server and distribute it to managed devices. MDM also maintains the expiry details to ensure the certificates are renewed regularly.
Follow the steps given below to add certificates to the MDM server:
Once the certificate is successfully added, the details such as expiry date, issuer name, the devices or groups the certificates are distributed to will be available on the MDM console. You can add multiple certificates by following the same steps.
Once the certificates are added to the MDM server, they can be installed on devices by either distributing them to Groups or to the respective devices.
Follow the steps given below to distribute certificates to Groups/devices:
For generating user-specific certificates, MDM must be integrated with the CA server to dynamically create certificates for the users.
MDM allows admins to integrate with CA servers with the help of a Simple Certificate Enrollment Protocol (SCEP) server.
To configure SCEP in MDM, first ensure the required pre-requisites are met. For the list of pre-requisites and the steps to configure them, refer this document.
Follow the steps given below to configure SCEP in MDM
Profile Specification |
Description |
|---|---|
Certificate Authority Name |
Specify the name of the Certificate Authority issuing certificates. |
Server URL |
The URL to be specified in the device to obtain certificate. Provide HTTP Server URL, if the SCEP server is within the organization network and not exposed to external networks. The certificate is requested through this URL. |
Thumbprint of CA Certificate |
The thumbprint of CA certificate is a unique identifier of the CA certificate. This information is available in the CA server and is not mandatory. |
For creating user-specific certificates, a template needs to be configured based on which all the certificates will be issued by the CA.
Follow the steps given below to configure the template on MDM:
Profile Specification |
Description |
|---|---|
Subject |
Specify the details (%username%, %email%, %domainname%,%devicename%) to map the corresponding details in the device. |
Subject Alternative Name Type |
Specify the alternate details(RFC 822 Name, DNS Name, Uniform Resource Identifier). |
Subject Alternative Name Type Value (Can be configured only if Subject Alternative Name Type is configured) |
Specify the value for alternative name type. |
NT Principal Name |
Specify the NT Principal Name used in the organization. |
Maximum Number of Failed Attempts |
Maximum number of attempts to obtain the certificate from the CA. |
Time interval between attempts |
Time to wait before subsequent attempts to obtain certificate |
Challenge Type |
A pre-shared secret key provided by the CA, which adds additional layer of security |
Enrollment Challenge Password |
Provide the challenge password to be used. Challenge Password can be identified as explained here. |
Key Size |
Specify whether the key is 1024 or 2048 bits |
Use as Digital Signature |
Enabling ensures the certificate can be used as Digital Signature |
Use for Key Encipherment |
Enabling ensures the certificate can be used as Key Encipherment |
Certificate Auto Renewal |
Enabling ensures the certificates are renewed immediately upon expiry. |
Most certificates require regular renewal and MDM intimates the admin about managed certificates that are about to expire, on the MDM console. The renewed certificates can be uploaded by following the steps given below:
Admins can choose to manually re-distribute the updated profiles to devices or automate the process by enabling the option Automatically re-distribute modified profiles to devices while uploading the new certificate.
| See Also: | Configure Mobile Device Manager Plus, Device Enrollment, Location Tracking, App Management, Profile Management, Asset Management, Security Management, Reports |
|
|