Product documentation
Citrix Endpoint Management
View PDF

SCEP device policy

March 7, 2024
Contributed by: 
K C

This policy lets you configure iOS and macOS devices to retrieve a certificate from an external SCEP server over the Simple Certificate Enrollment Protocol (SCEP). To deliver a certificate to devices using SCEP from a PKI that is connected to Citrix Endpoint Management, create a PKI entity and a PKI provider in distributed mode. For details, see PKI Entities.

To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

iOS settings

Device Policies configuration screen

  • URL base: Type the address of the SCEP server to define where SCEP requests are sent, over HTTP or HTTPS. The private key isn’t sent with the Certificate Signing Request (CSR), so it might be safe to send the request unencrypted. If the one-time password is configured for reuse, use HTTPS to protect the password. This step is required.
  • Instance name: Type any string that the SCEP server recognizes. For example, it can be a domain name like example.org. If a CA has multiple CA certificates, you can use this field to distinguish the required domain. This step is required.

  • Subject X.500 name (RFC 2253): Type the representation of an X.500 name as an array of Object Identifier (OID) and value. For example, /C=US/O=Apple Inc./CN=foo/1.2.5.3=bar, which translates to: [ [ [“C”, “US”] ], [ [“O”, “Apple Inc.”] ], …, [ [“1.2.5.3”, “bar” ] ] ]. You can represent OIDs as dotted numbers with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).

  • Subject alternative names type: Select an alternative name type. An optional alternative name type can provide the values required by the CA for issuing a certificate. You can specify None, RFC 822 name, DNS name, or URI.
  • Maximum retries: Type the number of times a device must retry when the SCEP server sends a PENDING response. The default is 3.
  • Retry delay: Type the number of seconds to wait between subsequent retries. The first retry is attempted without delay. The default is 10.
  • Challenge password: Enter a pre-shared secret.
  • Key size (bits): Select 2048 or higher as the key size in bits.
  • Use as digital signature: Choose whether to use the certificate as a digital signature. The SCEP server verifies the certificate use as a digital signature before using the public key to decrypt the hash.
  • Use for key encipherment: Choose whether to use the certificate for key encipherment. A server first checks whether the certificate provided by a client is allowed for key encipherment. Then the server uses the public key in a certificate to verify that a piece of data was encrypted using the private key. If not, the operation fails.

  • SHA-256 fingerprint (hexadecimal string): If your CA uses HTTP, use this field to provide the fingerprint of the CA certificate. The device uses the fingerprint to confirm the authenticity of the CA response during enrollment. You can provide an SHA-256 fingerprint, or you can select a certificate to import its signature.

  • Policy settings
    • Remove policy: Choose a method for scheduling policy removal. Available options are Select date and Duration until removal (in hours)
      • Select date: Click the calendar to select the specific date for removal.
      • Duration until removal (in hours): Type a number, in hours, until policy removal occurs. Only available for iOS 6.0 and later.

macOS settings

Device Policies configuration screen

  • URL base: Type the address of the SCEP server to define where SCEP requests are sent, over HTTP or HTTPS. The private key isn’t sent with the Certificate Signing Request (CSR), so it might be safe to send the request unencrypted. If the one-time password is configured for reuse, use HTTPS to protect the password. This step is required.
  • Instance name: Type any string that the SCEP server recognizes. For example, it can be a domain name like example.org. If a CA has multiple CA certificates, you can use this field to distinguish the required domain. This step is required.
  • Subject X.500 name (RFC 2253): Type the representation of an X.500 name as an array of Object Identifier (OID) and value. For example, /C=US/O=Apple Inc./CN=foo/1.2.5.3=bar, which translates to: [ [ [“C”, “US”] ], [ [“O”, “Apple Inc.”] ], …, [ [“1.2.5.3”, “bar” ] ] ]. You can represent OIDs as dotted numbers with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).
  • Subject alternative names type: Select an alternative name type. An optional alternative name type can provide the values required by the CA for issuing a certificate. You can specify None, RFC 822 name, DNS name, or URI.
  • Maximum retries: Type the number of times a device must retry when the SCEP server sends a PENDING response. The default is 3.
  • Retry delay: Type the number of seconds to wait between subsequent retries. The first retry is attempted without delay. The default is 10.
  • Challenge password: Type a pre-shared secret.
  • Key size (bits): Select 2048 or higher as the key size in bits.
  • Use as digital signature: Choose whether to use the certificate as a digital signature. The SCEP server verifies the certificate use as a digital signature before using the public key to decrypt the hash.
  • Use for key encipherment: Choose whether to use the certificate for key encipherment. A server first checks whether the certificate provided by a client is allowed for key encipherment. Then the server uses the public key in a certificate to verify that a piece of data was encrypted using the private key. If not, the operation fails.

  • SHA-256 fingerprint (hexadecimal string): If your CA uses HTTP, use this field to provide the fingerprint of the CA certificate. The device uses the fingerprint to confirm the authenticity of the CA response during enrollment. You can provide an SHA-256 fingerprint, or you can select a certificate to import its signature.

  • Policy settings
    • Remove policy: Choose a method for scheduling policy removal. Available options are Select date and Duration until removal (in hours)
      • Select date: Click the calendar to select the specific date for removal.
      • Duration until removal (in hours): Type a number, in hours, until policy removal occurs.
    • Allow user to remove policy: You can select when users can remove the policy from their device. Select Always, Passcode required, or Never from the menu. If you select Passcode required, type a passcode in the Removal passcode field.
    • Profile scope: Select whether this policy applies to a User or an entire System. The default is User. This option is available only on macOS 10.7 and later.
SCEP device policy
March 7, 2024
Contributed by: 
K C
March 7, 2024
Contributed by: 
K C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.