# Certificate Management

Last updated: August 13, 2026

This page explains how Mobile Device Manager Plus (MDM) simplifies certificate management for enterprise authentication across Exchange, Wi-Fi, and VPN. It covers the two types of certificates — trust certificates for organization-wide use and user-specific certificates issued via a Certificate Authority — along with steps to add, distribute, and renew certificates. Admins can also integrate CA servers using SCEP, configure certificate templates, and enable automatic redistribution of updated profiles to managed devices.

While passwords are commonly used for security and authentication purposes, many organizations now prefer using digitally signed certificates to authenticate the users before accessing Exchange server, Wi-Fi, VPN etc. Mobile Device Manager Plus (MDM) simplifies the creation, distribution and renewal of digitally signed certificates.

There are two types of commonly used certificates:

- [Trust certificates](https://www.manageengine.com/mobile-device-management/help/certificate_management/mdm_certificate_repository.html#trust)
- [User-specific certificates](https://www.manageengine.com/mobile-device-management/help/certificate_management/mdm_certificate_repository.html#user)

## Trust certificates

Admins use a single certificate which can be used to authenticate all the users in the organization. This trust certificate can be used by all the employees to authenticate the device while accessing their Exchange accounts and connecting to the Wi-fi or VPN.

To allow the users to authenticate their devices, the certificate must be present on the device. This can be done by distributing the certificate using MDM.

## User-specific certificates

Organizations integrate with a Certificate Authority (CA) that is responsible for issuing certificates and creates a certificate for every user in the organization. The CA authority when integrated with MDM, creates and distributes individual certificates for all the users accessing their Exchange accounts, Wi-fi or VPN.

MDM allows organizations to manage both trust and user-specific certificates with it's Certificate Management capabilities.

## Adding certificates to MDM

Admins can upload the required certificates on the MDM server and distribute it to managed devices. MDM also maintains the expiry details to ensure the certificates are renewed regularly.

Follow the steps given below to add certificates to MDM:

- On the console, navigate to **Device Mgmt > Certificates**
- In the Certificates tab, click on **Add Certificates**
- Upload the certificate file, and provide a password if applicable.
- Click on **Add Certificate.**

Once the certificate is successfully added, the details such as expiry date, issuer name, the devices or groups the certificates are distributed to will be available on the console. You can add multiple certificates by following the same steps.

## Distributing certificates to Groups/devices

Once the certificates are added to MDM, they can be installed on devices by either distributing them to Groups or to the respective devices.

Follow the steps given below to distribute certificates to Groups/devices:

- Navigate to **Device Mgmt > Profiles**
- Click on **Create Profile** and select the OS for which you want to create the profile.
- Select the policy, for which certificate based authentication needs to be configured. MDM supports certificate based authentication for Wi-Fi, VPN, Exchange ActiveSync, Email and Enterprise SSO (iOS specific feature).
- Provide the required details and for the **Certificates** option, select any of the certificates listed. You can also add new certificates from the same view.

## Integrating CA servers with MDM

For generating user-specific certificates, MDM must be integrated with the CA server to dynamically create certificates for the users.

MDM allows admins to integrate with CA servers with the help of a Simple Certificate Enrollment Protocol (SCEP) server.

### Configuring SCEP in MDM

To configure SCEP in MDM, first ensure the required pre-requisites are met. For the list of pre-requisites and the steps to configure them, refer [this document](https://www.manageengine.com/mobile-device-management/help/profile_management/ios/mdm_scep.html#pre-requisites).

Follow the steps given below to configure SCEP in MDM:

- Navigate to **Device Mgmt -> Certificates**
- Click on the **CA Servers** tab and click on **Add CA server**
- Provide the following details:

| Profile Specification | Description |
|---|---|
| Certificate Authority Name | Specify the name of the Certificate Authority issuing certificates. |
| Server URL | The URL to be specified in the device to obtain certificate. Provide HTTP Server URL, if the SCEP server is within the organization network and not exposed to external networks. The certificate is requested through this URL. For [NDES](http://social.technet.microsoft.com/wiki/contents/articles/9063.network-device-enrollment-service-ndes-in-active-directory-certificate-services-ad-cs.aspx), the server URL format: **http://<your-server>/CertSrv/mscep/mscep.dll** |

## Creating templates for the CA servers

For creating user-specific certificates, a template needs to be configured based on which all the certificates will be issued by the CA.

Follow the steps given below to configure the template on MDM:

- On the console, navigate to **Device Mgmt > Certificates**.
- Click on the **Templates** tab and click on **Add Templates**
- Provide the following details:

| Profile Specification | Description |
|---|---|
| Subject | Specify the details (%username%, %email%, %domainname%,%devicename%) to map the corresponding details in the device. |
| Subject Alternative Name Type | Specify the alternate details(RFC 822 Name, DNS Name, Uniform Resource Identifier). |
| Subject Alternative Name Type Value **(Can be configured only if Subject Alternative Name Type is configured)** | Specify the value for alternative name type. |
| NT Principal Name | Specify the NT Principal Name used in the organization. |
| Maximum Number of Failed Attempts | Maximum number of attempts to obtain the certificate from the CA. |
| Time interval between attempts | Time to wait before subsequent attempts to obtain certificate |
| Challenge Type | A pre-shared secret key provided by the CA, which adds additional layer of security. If **Static** is chosen, all the devices will use the same password for authentication. If **Dynamic** is chosen, each device will receive a unique challenge password for authentication. |
| Enrollment Challenge Password | Provide the challenge password to be used. Challenge Password can be identified as explained [here](https://www.manageengine.com/mobile-device-management/help/certificate_management/mdm_certificate_repository.html#scep). |
| Key Size | Specify whether the key is 1024 or 2048 bits |
| Use as Digital Signature | Enabling this ensures the certificate can be used as Digital Signature |
| Use for Key Encipherment | Enabling this ensures the certificate can be used as Key Encipherment |
| Certificate Auto Renewal | Enabling this ensures the certificates are renewed immediately upon expiry. |

## Modifying or Renewing Certificates

Most certificates require regular renewal and MDM intimates the admin about managed certificates that are about to expire, on the console. The renewed certificates can be uploaded by following the steps given below:

- Select the certificate to be updated, and click on **Modify**.
- Upload the renewed certificate and click on the **Modify Certificate** button to upload the new certificate.
- This will automatically update the certificate on the profiles it was previously associated to.

Admins can choose to manually [re-distribute the updated profiles to devices](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_associating_profiles_to_devices.html) or automate the process by enabling the option **Automatically re-distribute modified profiles to devices** while uploading the new certificate.

**Note:** To comply with Microsoft’s certificate-based authentication changes introduced in [KB5014754](https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16), SCEP certificates now include a SID tag in the Subject Alternative Name (SAN) field: *tag:microsoft.com,2022-09-14:sid:<value>*  
This tag helps map the certificate to a user SID synced from on-premises Active Directory or Entra ID (hybrid-AD).

## Support for Certificate-Based Authentication Changes (KB5014754)

As detailed in [Microsoft KB5014754](https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16), Windows domain controllers now enforce stronger validation for certificate-based authentication, including support for strong certificate mappings using the `onPremisesSecurityIdentifier`.

To meet these requirements and ensure successful authentication, the SCEP certificate profile deployment via MDM has been updated accordingly.

1. In the MDM console, navigate to: Device Mgmt > Certificates > Templates. Select the relevant certificate template and click **Modify**.
2. Based on [Microsoft documentation](https://techcommunity.microsoft.com/blog/askds/preview-of-san-uri-for-certificate-strong-mapping-for-kb5014754/3789785), configure the Subject Alternative Name (SAN) field to include the SID as a Uniform Resource Identifier (URI).

   Set the Subject Alternate Name Type to: **Uniform Resource Identifier**

   Set the Subject Alternative Name Value to: **tag:microsoft.com,2022-09-14:sid:%on_premises_security_identifier%**
3. Click **Save** to apply the changes.
4. Re-deploy the updated SCEP certificate profiles to all targeted devices.
5. Ensure each device is assigned to the correct user so that the %on_premises_security_identifier% value is populated correctly during certificate issuance.

![Update View](https://cdn.manageengine.com/mobile-device-management/help/images/binding.png)

### Additional Notes

- Certificates issued via **online templates** (e.g., AD Certificate payloads) automatically include the SID and **are not affected** by this change.
- This configuration is required **only** for certificates issued using **MDM-based SCEP workflows** where the SID is not embedded by default.

## Troubleshooting tips

1. **Why am I unable to upload a new SSL certificate when devices are managed in MDM?**

   When devices are managed using the existing self-signed certificate, MDM blocks the SSL certificate replacement to prevent the devices from losing communication with the server. **To resolve this while keeping devices managed:**

   1. First, distribute the new SSL self-signed certificate to all managed devices using profile distribution.
   2. Once distributed, proceed to upload the new SSL certificate on the server.

2. **Why did the profile association fail with “subject name contains special characters”?**

   The profile association failed because the subject name is not in the required LDAP Distinguished Name (DN) format. Enter the subject using the LDAP DN structure in the Subject field, for example:

   `CN=%username%,CN=Users,DC=domain,DC=com`

   Use dynamic variables such as `%username%`, `%email%`, or `%domainname%` where applicable, save the template, and then re-associate it.

## Frequently Asked Questions

### 1. What is the difference between trust certificates and user-specific certificates?

A trust certificate is a single certificate used by all employees in the organization to authenticate their devices while accessing Exchange, Wi-Fi, or VPN. A user-specific certificate is unique per user and is issued dynamically by an integrated Certificate Authority.

### 2. Do I need to integrate a CA server to use certificate-based authentication?

Only if you want user-specific certificates. Trust certificates can be uploaded and distributed directly from the MDM console without integrating a CA server. User-specific certificates require integrating a CA server via SCEP.

### 3. What happens when I upload a renewed certificate?

Once you modify a certificate with its renewed version, MDM automatically updates it on all profiles the certificate was previously associated with. You can also enable automatic re-distribution of modified profiles to devices while uploading the new certificate.

### 4. Why do SCEP certificates now include a SID tag in the Subject Alternative Name field?

This is to comply with Microsoft's certificate-based authentication changes introduced in KB5014754. The SID tag helps map the certificate to a user SID synced from on-premises Active Directory or Entra ID (hybrid-AD) for stronger certificate-based authentication on Windows domain controllers.

### 5. Are certificates issued through online templates, such as AD Certificate payloads, affected by the KB5014754 change?

No. Certificates issued via online templates automatically include the SID and are not affected. The additional Subject Alternative Name configuration is required only for certificates issued using MDM-based SCEP workflows, where the SID is not embedded by default.