How-To: Manage Certificates in Keytos Shield on Keytos Docs

How-To: Issue SCEP Certificates with Keytos Shield Cloud PKI

Wed, 28 Oct 2026 09:00:00 -0400

Using Jamf Pro or Another MDM That Supports ACME?

If your MDM supports ACME device attestation, see how to issue ACME certificates instead of using SCEP.

Overview - How to Issue SCEP Certificates with Keytos Shield

The Simple Certificate Enrollment Protocol (SCEP) is the most widely supported way for a mobile device management (MDM) platform to request a unique certificate for each device or user. Keytos Shield hosts the SCEP service for you, so you can issue certificates for passwordless Wi-Fi and network authentication without running a SCEP server. This guide shows you how to find your Shield SCEP URL, give it to your MDM, and confirm that certificates are being issued.

How-To: Issue ACME Device Certificates with Keytos Shield Cloud PKI

Wed, 28 Oct 2026 09:00:00 -0400

Looking to Issue Certificates for Web Servers?

This guide covers ACME device attestation for managed devices. Keytos Shield does not support HTTP or DNS ACME for server SSL certificates at this time. To issue a certificate for a server or appliance, see how to create a generic server certificate.

Overview - How to Issue ACME Certificates to Managed Devices with Keytos Shield

The Automated Certificate Management Environment (ACME) protocol lets a managed device request its own certificate directly from Keytos Shield. Unlike static SCEP, which relies on a shared password, ACME device attestation lets Shield confirm that each certificate request comes from a real, managed device, and your MDM can bind the private key to the device hardware. Keytos Shield hosts the ACME service for you, so you can issue certificates for passwordless Wi-Fi and network authentication without running any servers.

How-To: Create a RadSec Client Certificate in Keytos Shield

Wed, 28 Oct 2026 09:00:00 -0400

Overview - What is a RadSec Client Certificate?

When a network access point or switch connects to Keytos Shield via RadSec (RADIUS over TLS), it needs to present a client certificate that Keytos Shield can trust and validate. Some network devices, such as Cisco Meraki, use a certificate issued by the vendor’s own CA. However, for other network devices such as Unifi, you will need to install a RadSec client certificate that you created in Keytos Shield. This guide will go over creating a RadSec client certificate in Keytos Shield for RadSec authentication with your network controller.

How-To: Create a Domain Controller Certificate in Keytos Shield

Wed, 28 Oct 2026 09:00:00 -0400

Step-by-Step Guide - How to Issue Domain Controller Certificates in Keytos Shield

Follow these steps to create and issue domain controller certificates in Keytos Shield.

Prerequisites for Creating Domain Controller Certificates in Keytos Shield

Before you begin creating domain controller certificates in Keytos Shield, ensure that you have completed all the necessary prerequisites:

The Keytos Entra ID applications are registered in your tenant.
You have signed up for a Keytos Shield Plan.
You are a Subscription Owner or Network Administrator.
You have completed the Keytos Shield Network Security onboarding
- Make sure you selected Hybrid infrastructure for What type of environment do you have? during onboarding.
You have pushed your CA certificates to your Intune devices

Step 1 - How to Trust Your Keytos Shield CA Certificates in Active Directory

The first step is to add the Keytos Shield CA certificates to the NTAuth Store. This will enable the certificate to be used for authentication in Active Directory.

How-To: Issue a Server Certificate in Keytos Shield

Wed, 28 Oct 2026 09:00:00 -0400

Looking to issue client certificates to your users and devices?

Check out our guides for distributing client certificates via your Mobile Device Management (MDM) platform.

What Is a Server Certificate in Keytos Shield?

A server certificate is issued by Shield’s certificate authority (CA), with custom subject, names, lifetime and usages that you determine. This is most useful for anything that needs to trust Shield in your network: servers, appliances, domain controllers, or devices that don’t fit the built-in RadSec flow.

How-To: View Certificate Logs in Keytos Shield

Wed, 28 Oct 2026 09:00:00 -0400

Overview - How to View and Audit Issued Certificates in Keytos Shield

The Keytos Shield Certificate logs page is your audit trail for certificate issuance. It lists every certificate that the Shield network certificate authority issued to your devices, so you can answer questions such as which certificate a device is using, when it was issued, and how it was requested. This guide shows you how to open the logs, filter them, and understand every column.

How-To: View and Revoke Certificates in Keytos Shield

Wed, 28 Oct 2026 09:00:00 -0400

Overview - How to View and Revoke a Device or Network Certificate in Keytos Shield

When a laptop is lost, an employee leaves, or a private key may have been exposed, you should not have to wait for the certificate to expire. In Keytos Shield, you can view and revoke any certificate your network certificate authority issued from the Certificates page. Revoking adds the certificate to your certificate authority’s revocation list, so the device using it can no longer connect once your network picks up the change. This guide shows you how to find the right certificate and revoke it.