How-To: Manage Certificates in Keytos Shield
Overview - How to Manage Certificates in Keytos Shield
Keytos Shield includes a cloud PKI that can issue certificates to your devices, users, and network equipment that use them to authenticate to your network. This section covers the whole certificate lifecycle, from issuing certificates to your devices and servers, seeing exactly which certificates were issued and when, and revoking a certificate as soon as it should no longer be trusted.
What Can I Do in the Manage Certificates Section?
Pick the task that matches what you are trying to do:
| I want to… | Guide |
|---|---|
| Issue certificates to Intune or other MDM-managed devices | How to issue SCEP certificates |
| Issue hardware-bound certificates to Apple devices managed by Jamf Pro | How to issue ACME certificates |
| Connect my access points or other network equipment to Shield with RadSec | How to create a RadSec client certificate |
| Issue a certificate for a domain controller | How to create a domain controller certificate |
| Issue a certificate for a server or appliance with a custom subject, names, and lifetime | How to create a generic server certificate |
| See which certificates were issued, who requested them, and when | How to view certificate logs |
| Stop a lost, stolen, or compromised certificate from connecting to my network | How to revoke certificates |
Should I Use SCEP or ACME to Issue Certificates to My Devices?
It depends on your MDM and your OS. Both protocols deliver a unique certificate to each device, and Keytos Shield hosts both for you, so there is no server to run.
- SCEP: Use this with Microsoft Intune, NinjaOne, SimpleMDM, and other MDM platforms that can send a SCEP profile. Intune uses dynamic SCEP, where Shield validates the challenge Intune generates for each device. Other MDMs use static SCEP, which relies on a single shared URL and password.
- ACME: Use this with MDM platforms and operating systems that support ACME device attestation, such as Jamf Pro with Apple devices. ACME proves each device’s identity to Shield instead of relying on a shared password, so we recommend it whenever your MDM supports it.
Keytos Shield does not currently support HTTP or DNS ACME for server SSL certificates. To issue a certificate to a server or appliance, you can manually issue a server certificate, or deploy an additional EZCA SSL CA.
Where Do I Find My Issued Certificates in Keytos Shield?
Every certificate that Keytos Shield issues appears in two places in your Shield portal under Network security:
- Certificates: A snapshot of all certificates your network certificate authority has issued.
- Certificate logs: View a detailed audit log of all certificate requests, including who requested them and when.