# Certificate Management

While passwords are commonly used for security and authentication purposes, many organizations now prefer using digitally signed certificates to authenticate users before accessing Exchange server, Wi-Fi, VPN, etc. This reduces the chances of forgotten passwords and numerous password resets. **Mobile Device Manager Plus (MDM)** simplifies the creation, distribution, and renewal of digitally signed certificates.

There are two types of commonly used certificates:

- [Trust certificates](#trust-certificates)
- [User-specific certificates](#user-specific-certificates)

## Trust certificates

Admins use a single certificate which can be used to authenticate all the users in the organization. This trust certificate can be used by all employees to authenticate the device while accessing their Exchange accounts and connecting to Wi-Fi or VPN.

To allow users to authenticate their devices, the certificate must be present on the device. This can be done by distributing the certificate using MDM.

## User-specific certificates

Organizations integrate with a Certificate Authority (CA) that is responsible for issuing certificates and creates a certificate for every user in the organization. When integrated with MDM, the CA creates and distributes individual certificates for all users accessing their Exchange accounts, Wi-Fi, or VPN.

MDM allows organizations to manage both trust and user-specific certificates with its Certificate Management capabilities.

## Adding certificates to MDM

Admins can upload the required certificates on the MDM server and distribute them to managed devices. MDM also maintains expiry details to ensure certificates are renewed regularly.

Follow the steps below to add certificates to MDM:

- On the console, navigate to **Device Mgmt > Certificates**
- In the Certificates tab, click on **Add Certificates**
- Upload the certificate file, and provide a password if applicable
- Click on **Add Certificate**

Once the certificate is successfully added, details such as expiry date, issuer name, and the devices or groups the certificates are distributed to will be available on the console. You can add multiple certificates by following the same steps.

## Distributing certificates to Groups/devices

Once certificates are added to MDM, they can be installed on devices by distributing them to groups or individual devices.

Follow the steps below to distribute certificates:

- Navigate to **Device Mgmt > Profiles**
- Click on **Create Profile** and select the OS for which you want to create the profile
- Select the policy for which certificate-based authentication needs to be configured. MDM supports certificate-based authentication for Wi-Fi, VPN, Exchange ActiveSync, Email, and Enterprise SSO (iOS-specific feature)
- Provide the required details and for the **Certificates** option, select any of the listed certificates. You can also add new certificates from the same view

## Integrating CA servers with MDM

For generating user-specific certificates, MDM must be integrated with the CA server to dynamically create certificates for users.

MDM allows admins to integrate with CA servers using a Simple Certificate Enrollment Protocol (SCEP) server.

### Configuring SCEP in MDM

Before configuring SCEP, ensure the required prerequisites are met. Refer to [this document](https://www.manageengine.com/mobile-device-management/help/profile_management/ios/mdm_scep.html#pre-requisites) for the list of prerequisites and configuration steps.

Follow the steps below to configure SCEP in MDM:

- Navigate to **Device Mgmt -> Certificates**
- Click on the **CA Servers** tab and click on **Add CA server**
- Provide the following details:

| Profile Specification | Description |
|---|---|
| Certificate Authority Name | Specify the name of the Certificate Authority issuing certificates. |
| Server URL | The URL to be specified in the device to obtain certificate. Provide HTTP Server URL if the SCEP server is within the organization network and not exposed to external networks. The certificate is requested through this URL. For [NDES](http://social.technet.microsoft.com/wiki/contents/articles/9063.network-device-enrollment-service-ndes-in-active-directory-certificate-services-ad-cs.aspx), the server URL format: **http://<your-server>/CertSrv/mscep/mscep.dll** |

## Creating templates for the CA servers

For creating user-specific certificates, a template must be configured based on which all certificates will be issued by the CA.

Follow the steps below to configure the template in MDM:

- On the console, navigate to **Device Mgmt > Certificates**
- Click on the **Templates** tab and click on **Add Templates**
- Provide the following details:

| Profile Specification | Description |
|---|---|
| Subject | Specify the details (%username%, %email%, %domainname%, %devicename%) to map the corresponding details in the device. |
| Subject Alternative Name Type | Specify the alternate details (RFC 822 Name, DNS Name, Uniform Resource Identifier). |
| Subject Alternative Name Type Value (Can be configured only if Subject Alternative Name Type is configured) | Specify the value for the alternative name type. |
| NT Principal Name | Specify the NT Principal Name used in the organization. |
| Maximum Number of Failed Attempts | Maximum number of attempts to obtain the certificate from the CA. |
| Time interval between attempts | Time to wait before subsequent attempts to obtain the certificate. |
| Challenge Type | A pre-shared secret key provided by the CA, which adds an additional layer of security. If **Static** is chosen, all devices use the same password for authentication. If **Dynamic** is chosen, each device receives a unique challenge password for authentication. |
| Enrollment Challenge Password | Provide the challenge password to be used. Challenge Password can be identified as explained [here](#scep). |
| Key Size | Specify whether the key is 1024 or 2048 bits. |
| Use as Digital Signature | Enabling this ensures the certificate can be used as a digital signature. |
| Use for Key Encipherment | Enabling this ensures the certificate can be used for key encipherment. |
| Certificate Auto Renewal | Enabling this ensures certificates are renewed immediately upon expiry. |

## Modifying or Renewing Certificates

Most certificates require regular renewal, and MDM notifies the admin about managed certificates that are about to expire on the console. Renewed certificates can be uploaded by following the steps below:

- Select the certificate to be updated and click on **Modify**
- Upload the renewed certificate and click on **Modify Certificate** to upload the new certificate
- This automatically updates the certificate on the profiles it was previously associated with

Admins can manually [re-distribute the updated profiles to devices](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_associating_profiles_to_devices.html) or automate the process by enabling **Automatically re-distribute modified profiles to devices** while uploading the new certificate.

**Note:** To comply with Microsoft’s certificate-based authentication changes introduced in [KB5014754](https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16), SCEP certificates now include a SID tag in the Subject Alternative Name (SAN) field:  
*tag:microsoft.com,2022-09-14:sid:<value>*  
This tag helps map the certificate to a user SID synced from on-premises Active Directory or Entra ID (hybrid-AD).

## Support for Certificate-Based Authentication Changes (KB5014754)

As detailed in [Microsoft KB5014754](https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16), Windows domain controllers now enforce stronger validation for certificate-based authentication, including support for strong certificate mappings using the `onPremisesSecurityIdentifier`.

To meet these requirements and ensure successful authentication, the SCEP certificate profile deployment via MDM has been updated accordingly.

1. In the MDM console, navigate to: **Device Mgmt > Certificates > Templates**. Select the relevant certificate template and click **Modify**.
2. Based on [Microsoft documentation](https://techcommunity.microsoft.com/blog/askds/preview-of-san-uri-for-certificate-strong-mapping-for-kb5014754/3789785), configure the Subject Alternative Name (SAN) field to include the SID as a Uniform Resource Identifier (URI).  
   Set the Subject Alternate Name Type to: **Uniform Resource Identifier**  
   Set the Subject Alternative Name Value to: **tag:microsoft.com,2022-09-14:sid:%on_premises_security_identifier%**
3. Click **Save** to apply the changes.
4. Re-deploy the updated SCEP certificate profiles to all targeted devices.
5. Ensure each device is assigned to the correct user so that the %on_premises_security_identifier% value is populated correctly during certificate issuance.

![Update View](https://cdn.manageengine.com/mobile-device-management/help/images/binding.png)

### Additional Notes

- Certificates issued via **online templates** (e.g., AD Certificate payloads) automatically include the SID and **are not affected** by this change.
- This configuration is required **only** for certificates issued using **MDM-based SCEP workflows** where the SID is not embedded by default.

## Troubleshooting tips

1. **Why am I unable to upload a new SSL certificate when devices are managed in MDM?**  
   When devices are managed using the existing self-signed certificate, MDM blocks SSL certificate replacement to prevent devices from losing communication with the server.  
   **To resolve this while keeping devices managed:**
   1. First, distribute the new SSL self-signed certificate to all managed devices using profile distribution.
   2. Once distributed, upload the new SSL certificate on the server.

2. **Why did the profile association fail with “subject name contains special characters”?**  
   The profile association failed because the subject name is not in the required LDAP Distinguished Name (DN) format. Enter the subject using the LDAP DN structure in the Subject field, for example:

   ```
   CN=%username%,CN=Users,DC=domain,DC=com
   ```

   Use dynamic variables such as `%username%`, `%email%`, or `%domainname%` where applicable, save the template, and then re-associate it.