How-To: Issue SCEP Certificates in Jamf

Overview - What is Jamf?

Jamf is an Apple device management solution that allows organizations to manage and secure their Apple devices, including iPhones, iPads, and Macs. As part of its device management capabilities, Jamf supports the issuance of SCEP (Simple Certificate Enrollment Protocol) certificates to enrolled devices, which can be used for various authentication purposes such as Wi-Fi and VPN.

Does Jamf Support SCEP Certificates?

Yes! Jamf Pro has native support for SCEP certificate issuance, and Jamf Now allows you to include an Apple Configurator profile with SCEP as well. This means you can configure Jamf Pro and Jamf Now to automatically issue SCEP certificates to your enrolled devices using your EZCA SCEP CA.

Are SCEP Certificates Cleaned Up When a Device is Unenrolled from Jamf?

Yes. When a device is removed from Jamf Pro or Jamf Now, any SCEP certificates that were issued to that device, including the private key, will be removed from the device. This helps ensure that certificates are not left behind on devices that are no longer managed by Jamf, which can help improve security and reduce the risk of orphaned certificates being misused.

Are SCEP Certificates Automatically Renewed in Jamf?

Yes. Jamf Pro and Jamf Now can be configured to automatically renew SCEP certificates before they expire. This helps ensure that devices always have valid certificates for authentication purposes without requiring manual intervention from administrators or users. The renewal process typically involves the device requesting a new certificate from the SCEP CA before the current certificate expires, allowing for seamless certificate management.

How to Configure Jamf to Issue SCEP Certificates