How-To: Issue SCEP Certificates in SimpleMDM

Navigate to your EZCA portal and sign in as a PKI Administrator.

Click on the Certificate Authorities tab and scroll to your SCEP CA.

Click on the View Requirements button for your SCEP CA.

Scroll down to the CA Locations section and click on the Download Certificate button for your CA.

Navigate to your EZCA portal and sign in as a PKI Administrator.

Click on the Certificate Authorities tab and scroll to your SCEP CA.

Click on View Requirements for your SCEP CA.

Check the box for Enable SCEP Static Challenge and click Save Changes. You will now see your Static Challenge SCEP URL and SCEP Challenge:

Start on a macOS device with Apple Configurator installed.

Open Apple Configurator, and click on File → New Profile to create a new configuration profile.

Fill out the General section with a name, identifier, and description for the profile.

Click on the Certificates section and then click on the Configure button to add a new certificate payload.

Select the CA certificate you downloaded from EZCA and upload it to the profile. This will ensure that the CA certificates are pushed to the devices and that they trust the SCEP CA.

Repeat the process to upload the root CA certificate if your SCEP CA is a subordinate CA.

Next, click on the SCEP section and click on the Configure button to add a new SCEP payload.

Copy the Static Challenge SCEP URL from your EZCA portal and paste it into the URL field in Apple Configurator. Do the same for the Static Challenge in the Challenge field.

Configure the remaining fields:

• Name: Set as the name of your SCEP CA
• Subject: Use a static value or Apple’s built-in variables (e.g. CN=%HardwareUUID%)
• Subject Alternative Name Type: Set as DNS Name
• Subject Alternative Name Value: Use a static value or Apple’s built-in variables (e.g. %HostName%)
• Key Size: Set as 2048 or higher.
• Key Usage: Set as “Sign” and “Key Encipherment”.

You should now have a complete SCEP configuration in your custom profile:

Save the profile to your device as a .mobileconfig file.

Navigate to your EZCA portal and sign in as a PKI Administrator.

Click on the Certificate Authorities tab and scroll to your SCEP CA.

Click on the View Requirements button for your SCEP CA.

Scroll down to the CA Locations section and click on the Download Certificate button for your CA.

Navigate to your EZCA portal and sign in as a PKI Administrator.

Click on the Certificate Authorities tab and scroll to your SCEP CA.

Click on View Requirements for your SCEP CA.

Check the box for Enable SCEP Static Challenge and click Save Changes. You will now see your Static Challenge SCEP URL and SCEP Challenge:

Download and install iMazing Profile Editor.

Open iMazing Profile Editor, and click on File → New Profile to create a new configuration profile.

Fill out the General section with a name and description for the profile.

Click on the Root Certificate section and then click on the Add Payload button to add a new certificate payload.

Select the Root CA certificate you downloaded from EZCA and upload it to the profile. This will ensure that the Root CA certificates are pushed to the devices and that they trust the SCEP Root CA.

Repeat the process to upload the CA certificate if your SCEP CA is a subordinate CA.

Next, click on the SCEP section and click on the Add Payload button to add a new SCEP payload.

Copy the Static Challenge SCEP URL from your EZCA portal and paste it into the URL field in iMazing Profile Editor.

Copy the Challenge from EZCA and paste it into the Challenge field.

Configure the remaining fields:

• Subject: Use a static value or Apple’s built-in variables (e.g. CN=%HardwareUUID%)

• Retries: 3

• Retry Delay: 30

• Key Size: Set as 2048 or higher.

• Key Usage: Set as Both signing and encryption.

  

You should now have a complete SCEP configuration in your custom profile:

Click File → Save to save the profile to your device as a .mobileconfig file.