How-To: Distribute Keytos Shield Network Profiles to Apple Devices with Iru (formerly Kandji)

Learn how to set up Keytos Shield with Iru MDM (formerly Kandji) to issue SCEP certificates and push an EAP-TLS Wi-Fi profile so your Apple devices connect to Wi-Fi automatically.

Overview - How to Set Up Certificate-Based Wi-Fi for Iru Managed Apple Devices with Keytos Shield

Iru (formerly Kandji) is a device management platform for macOS, iOS, iPadOS, tvOS, and visionOS devices, among others. Pairing Iru with Keytos Shield lets every managed Apple device get its own certificate from your Shield Cloud PKI and use it to join your Wi-Fi with passwordless EAP-TLS authentication, so there is no shared Wi-Fi password to leak or rotate.

This guide walks you through enabling static SCEP in Keytos Shield, adding your Shield Root CA to Iru, and building an Iru Wi-Fi Library Item that requests a certificate from Shield and connects your devices to your network automatically.

How Does Keytos Shield Work with Iru on Apple Devices?

Connecting an Iru managed Apple device to your Shield-protected network takes three pieces, which you will configure in this guide:

  1. Trusted certificate: Your Shield Root CA certificate is pushed to your devices so they trust your Shield RADIUS servers and the certificates Shield issues.
  2. SCEP certificate: Each device requests its own unique certificate from Keytos Shield using the Simple Certificate Enrollment Protocol (SCEP). Iru uses Shield’s static SCEP URL and password to request the certificate on the device’s behalf.
  3. Wi-Fi profile: The Wi-Fi profile tells the device which network to join, to authenticate with EAP-TLS using its SCEP certificate, and which RADIUS servers to trust.

In Iru, the SCEP certificate is configured inside the Wi-Fi Library Item. Apple devices require the identity certificate to be in the same configuration profile as the Wi-Fi settings that use it, so you don’t need a separate SCEP Library Item.

Prerequisites for Distributing Keytos Shield Network Profiles with Iru

Before you begin, make sure you have completed the following:

  1. The Keytos Entra ID applications are registered in your tenant.
  2. You have signed up for a Keytos Shield Plan.
  3. You have existing access policies in Keytos Shield.
  4. You are a Subscription Owner or Network Administrator.
  5. You are an Iru Administrator.

You also need Apple Push Notification service (APNs) configured in Iru, with your devices enrolled, so Iru can push profiles to them.

Step-by-Step Guide - How to Issue SCEP Certificates and Push a Wi-Fi Profile to Apple Devices with Keytos Shield and Iru

Step 1 - How to Enable Static SCEP for Iru in Keytos Shield

Iru requests certificates from Keytos Shield with static SCEP. To turn it on, tell Shield that you manage devices with an MDM other than the ones listed by name by enabling Other MDM. Enabling it also updates your certificate authority to support static SCEP.

In step 2, Tell us about your environment, of the Keytos Shield network security onboarding guide, ensure you have checked Other MDM, in addition to any other MDMs in your environment.

How to Enable Other MDM in Keytos Shield onboarding guide

If you’ve already gone through the onboarding guide, you can update the list of MDMs you manage devices with.

  1. Navigate to the Keytos Shield Network profiles page from the left-hand menu.

  2. At the top of the page, select the Settings tab.

    Keytos Shield Network profiles with the Settings tab highlighted

  3. Scroll down to the bottom of the page and expand the Mobile Device Management section.

  4. Ensure you have checked Other MDM in addition to any other MDMs in your environment.

    How to Enable Other MDM in Keytos Shield network policies page

Step 2 - How to Download Your Keytos Shield Root CA Certificate

Your devices need your Shield Root CA certificate so they trust your Shield RADIUS servers and the certificates Shield issues.

You can download your Shield Root CA certificate from the onboarding guide or from the network profiles page.

If you’re currently going through the onboarding guide, you can download your Shield Root CA certificate in step 6, Set Up Mobile Device Management (MDM).

  1. In step 6 of the Keytos Shield onboarding guide, expand Other MDM.

  2. Under Download Root CA Certificate File, click Download next to rootca.cer and save it to your local machine.

    Keytos Shield onboarding guide Set Up Mobile Device Management (MDM) step showing Other MDM with the rootca.cer Download button highlighted

If you’ve already gone through the onboarding guide, you can download your Shield Root CA certificate from the network profiles page.

  1. Log in to your Keytos Shield portal.

  2. From the left-hand navigation bar, click on Network Profiles.

  3. At the top of the page, select the Settings tab.

    Keytos Shield Settings tab highlighted

  4. Scroll down to the Certificate Authority and Enrollment section and expand the Other MDM subsection.

    Not seeing the Other MDM subsection? Make sure to enable Other MDM under the Mobile Device Management section further up on the page and save your changes.

  5. Next to rootca.cer, click Download and save it to your local machine.

  6. Next to issuingca.cer, click Download and save it to your local machine as well.

    Keytos Shield Download Root CA and Issuing CA Certificate File button highlighted

Iru only needs the rootca.cer file. You use it in the next step and again when you configure RADIUS server trust in the Wi-Fi profile.

Step 3 - How to Add Your Keytos Shield Root CA as a Trusted Certificate in Iru

Now push your Shield Root CA to your devices so they trust the certificates Shield issues. You do this with a Certificate Library Item in Iru.

  1. Log in to your Iru tenant.

  2. From the left-hand menu, click Library.

  3. Click Add Library Item.

    Iru Library page with the Library menu item and Add Library Item button highlighted

  4. Search for Certificate, select the Certificate profile, and click Add and configure.

    Iru Add Library Item page with the Certificate profile and Add and configure button highlighted

  5. Enter a title for the Library Item, such as Keytos Shield Root CA.

  6. For Certificate type, select PKCS #1-formatted certificate.

  7. Under Certificate, upload the rootca.cer file you downloaded from Keytos Shield.

    Iru Certificate Library Item with the title, PKCS #1-formatted certificate type, and uploaded rootca.cer highlighted

  8. Under Apple only settings, enter a Certificate name, such as Keytos Shield Root CA.

  9. Click Save.

    Iru Certificate Library Item with Certificate name set to Keytos Shield Root CA and Save button highlighted

Step 4 - How to Get Your Keytos Shield Static SCEP URL and Password

Iru uses your Shield static SCEP URL and password to request a certificate for each device, so you will paste both values into the Wi-Fi profile.

You can copy your static SCEP URL and password from the onboarding guide or from the network profiles page. Keep them handy for the next steps.

If you’re currently going through the onboarding guide, you can copy your static SCEP URL and password in step 6, Set Up Mobile Device Management (MDM).

  1. In step 6 of the Keytos Shield onboarding guide, expand Other MDM.

  2. Click the Copy button next to the Static SCEP URL.

  3. Click the Copy button next to the Static SCEP password to copy the password without displaying it.

    Keytos Shield onboarding guide Other MDM section with the Static SCEP URL and Static SCEP password Copy buttons highlighted

If you’ve already gone through the onboarding guide, you can copy your static SCEP URL and password from the network profiles page. When you expand your MDM, select Other MDM.

  1. Log in to your Keytos Shield portal.

  2. From the left-hand menu, navigate to Network profiles.

  3. At the top of the page, select the Settings tab.

    Keytos Shield Settings tab highlighted

  4. Expand Certificate Authority and Enrollment, and then expand your MDM, such as NinjaOne or SimpleMDM.

    Not seeing your MDM? Make sure to enable it under the Mobile Device Management section further up on the page and save your changes.

  5. Click the Copy button next to the Static SCEP URL.

    Keytos Shield Copy Static SCEP URL button highlighted

  6. Click the Copy button next to the Static SCEP password to copy the password without displaying it. You will need both values when you create the SCEP profile in your MDM.

Step 5 - How to Get Your Keytos Shield RADIUS Server Names

To make sure your devices only send their certificate to your Shield RADIUS servers, the Wi-Fi profile needs the list of RADIUS server names.

You can copy your RADIUS server names from the onboarding guide or from the network profiles page.

If you’re currently going through the onboarding guide, you can copy your RADIUS server names in step 6, Set Up Mobile Device Management (MDM).

  1. In step 6 of the Keytos Shield onboarding guide, expand Other MDM.

  2. Scroll down to RADIUS server names and click Copy all to copy the full list.

    Keytos Shield onboarding guide Other MDM RADIUS server names list with the Copy all button highlighted

If you’ve already gone through the onboarding guide, you can copy your RADIUS server names from the network profiles page. When you expand your MDM’s section, select Other MDM.

  1. From within Network profiles > Settings in the Keytos Shield portal, expand Certificate Authority and Enrollment.

    Keytos Shield Settings tab highlighted

  2. Expand your MDM’s section to view the available configuration options.

  3. You will see a list of RADIUS server names for your network profile. You will need these in the next section.

    Keytos Shield RADIUS server names list

Step 6 - How to Create a Wi-Fi Profile with a Keytos Shield SCEP Certificate in Iru

Next, create the Wi-Fi Library Item. It tells your devices which network to join, requests a unique certificate from Keytos Shield with SCEP, and uses that certificate to authenticate with EAP-TLS.

How to Configure the Wi-Fi Network Settings in Iru

  1. In Iru, go to Library and click Add Library Item.

  2. Search for Wi-Fi, select the Wi-Fi profile, and click Add and configure.

  3. Enter a title for the Library Item, such as Keytos Shield Wi-Fi.

  4. Under Service Set Identifier (SSID), enter the name of your Wi-Fi network exactly as it is broadcast. It is case-sensitive.

  5. Leave Auto join network checked so devices connect on their own as soon as they are in range.

    Iru Wi-Fi Library Item with the title, SSID, and Auto join network setting highlighted

How to Configure EAP-TLS Authentication in Iru

  1. Scroll down to Authentication and set Authentication type to the enterprise security type your network uses, such as WPA2 Enterprise or WPA3 Enterprise.

  2. Under Apple only settings, open Accepted EAP Types and select TLS.

  3. Leave Username empty. The device identifies itself with its certificate.

  4. Set TLS minimum version to 1.2. We recommend blocking older TLS versions, which are no longer considered secure.

    Iru Wi-Fi Library Item authentication settings with WPA2 Enterprise, TLS EAP type, and TLS minimum version 1.2 highlighted

How to Configure the Keytos Shield SCEP Certificate in Iru

  1. Set Identity certificate to SCEP, then click Configure SCEP Certificate to open the Configure SCEP panel.

  2. In URL, paste the Static SCEP URL you copied from Keytos Shield.

  3. In Challenge, paste the Static SCEP password you copied from Keytos Shield.

  4. In Subject, enter a subject name that identifies the device, such as CN=$SERIAL_NUMBER. Iru replaces the variable with each device’s serial number. Use only device variables from the Iru global variables for all device families, such as $SERIAL_NUMBER or $DEVICE_ID. Iru also appends its $PROFILE_UUID variable to the CN if it is missing, which it needs to renew certificates automatically.

    Iru Configure SCEP panel with the Keytos Shield SCEP URL, Challenge, and Subject fields highlighted

  5. Check Subject Alternative Names (SAN), then set the SAN type to DNS Name and the value to $SERIAL_NUMBER. This makes the certificate a device certificate that identifies the device, not its user. As with the subject, use only device variables from the Iru global variables for all device families. Don’t use user variables such as $EMAIL or $USERNAME: they change when the device is reassigned and are empty when it has no assigned user.

  6. Set Key size to 2048 or higher. Leave Key usage as Both signing and encryption.

    Iru Configure SCEP panel with Subject Alternative Names set to DNS Name $SERIAL_NUMBER and Key size 2048 highlighted

  7. Under Additional options, check Automatic profile redistribution and enter 30 days before certificate expiration. We recommend keeping this enabled so Iru renews certificates before they expire. If you disable it, certificates can expire and your devices will lose Wi-Fi access.

  8. Check Prevent the private key data from being extracted in the keychain, so the certificate’s private key can’t be exported from the device.

    Iru Configure SCEP additional options with Automatic profile redistribution at 30 days and Prevent the private key data from being extracted highlighted

  9. Click Done to close the panel. The SCEP Certificate now appears under Identity certificate.

    Iru Wi-Fi Library Item with Identity certificate set to SCEP and the configured SCEP Certificate highlighted

How to Configure RADIUS Server Trust in Iru

  1. Scroll down to Certificate trust and check Specify trusted certificates.

  2. Upload the rootca.cer file you downloaded from Keytos Shield.

    Iru Wi-Fi Library Item Certificate trust section with Specify trusted certificates and the uploaded Keytos Shield rootca.cer highlighted

  3. Check Specify server certificate names.

  4. Click Add and enter each RADIUS server name you copied from Keytos Shield, one per row. Together with the trusted Root CA, this makes sure devices only send their certificate to your Shield RADIUS servers.

  5. Click Save.

    Iru Wi-Fi Library Item with the Keytos Shield RADIUS server names list and Save button highlighted

Step 7 - How to Assign the Keytos Shield Library Items to a Blueprint in Iru

Iru only installs Library Items that are assigned to a Blueprint. Assign both Library Items to the Blueprint your devices use.

  1. From the left-hand menu, click Blueprints and open the Blueprint your devices use, such as Default Blueprint.

  2. On the Assignment Map tab, click Edit assignments.

    Iru Default Blueprint Assignment Map with the Blueprints menu item and Edit assignments button highlighted

  3. Drag the Keytos Shield Root CA and Keytos Shield Wi-Fi Library Items from the Library Items list onto the map.

  4. Click Save, then click Save again in the Save changes? dialog.

    Iru Blueprint Assignment Map with Keytos Shield Root CA and Keytos Shield Wi-Fi assigned and Save button highlighted

Done! The next time your devices check in with Iru, they will install the Shield Root CA, request their own certificate from Keytos Shield, and join your Wi-Fi network automatically.

Step 8 - How to Test Your Keytos Shield Wi-Fi Configuration on macOS

Now that you have configured your Iru Wi-Fi profile to use Cloud RADIUS for authentication, the next step is to test the configuration on a managed macOS device. Follow these steps to test your Wi-Fi configuration:

  1. On a managed macOS device, click on the Wi-Fi icon in the menu bar and select the Wi-Fi network that you configured in your Iru Wi-Fi profile.

  2. If your configuration is correct, the device should successfully connect to the Wi-Fi network without any prompts.

    macOS device successfully connected to Wi-Fi

  3. If you are prompted to select a certificate for the network, your Wi-Fi profile is not fully configured: usually the RADIUS server’s Subject and Subject Alternative Names are missing from the trusted server names, a CA in the server certificate chain is not trusted, or the SCEP certificate has not been issued to the device yet.

You can also confirm in Keytos Shield that certificates are being issued. In your Shield portal, click Certificates in the left-hand menu to see each certificate Shield issued, or view your certificate logs.

Frequently Asked Questions About Keytos Shield and Iru

Does Keytos Shield Work with Iru (Formerly Kandji)?

Yes. Keytos Shield issues certificates to Iru managed Apple devices with static SCEP, and Iru pushes the Wi-Fi profile that uses those certificates to connect to your network with EAP-TLS.

Do I Need a Separate SCEP Library Item in Iru?

No. For Wi-Fi, configure the SCEP certificate inside the Wi-Fi Library Item, as shown in this guide. Apple devices require the identity certificate to be in the same configuration profile as the Wi-Fi settings. A separate SCEP Library Item would issue a second certificate that the Wi-Fi profile can’t use.

Why Do I Need to Add My RADIUS Server Names?

Specifying trusted server certificate names, together with your Shield Root CA, makes sure your devices only authenticate against your Shield RADIUS servers. Without them, a device could send its certificate to a rogue access point that impersonates your network.

How to Troubleshoot RADIUS Authentication for Keytos Shield

If your devices can’t connect to your network, refer to our troubleshooting guide.

🔎 Shield RADIUS Troubleshooting Guide