Category filter
Configure SCEP for iOS Devices in Hexnode UEM
TL;DR
- Use the iOS SCEP policy in Hexnode UEM to automate client certificate enrollment for iPhone and iPad devices.
- Select Microsoft CA (AD CS) for Microsoft Active Directory Certificate Services or Generic for another SCEP-compatible CA.
- Configure the SCEP server URL, subject, challenge, key settings, Subject Alternative Name, and CA certificate fingerprint as required by the CA.
- Associate the policy with devices, users, device groups, user groups, or Domains/OUs to deploy the certificate payload.
Simple Certificate Enrollment Protocol (SCEP) automates digital certificate enrollment for Apple iPhone and iPad devices managed through the iOS SCEP policy in Hexnode UEM. SCEP lets a managed device request a client certificate from a Certificate Authority (CA), receive the certificate, and install it without manually distributing certificate files. IT administrators use this workflow to issue identity certificates for Wi-Fi, VPN, and Email authentication so that trusted, managed devices can access corporate services.
In Hexnode UEM, the SCEP policy stores the enrollment settings and deploys them to selected devices, users, groups, or directory targets. The device uses those settings to communicate with the configured CA, generate the certificate request, and install the returned certificate.
How SCEP Certificate Enrollment Works for iOS Devices in Hexnode UEM
The SCEP payload in Hexnode UEM defines how an iOS device reaches the SCEP server and how the certificate request should be authenticated. The device receives the policy, generates the private key locally, submits the certificate request to the CA, and installs the issued certificate after the CA approves or returns the request.
The deployed certificate can be used as an identity certificate in supported authentication workflows, such as Wi-Fi and VPN policies. Use wildcards in the Subject or Subject Alternative Name fields when the certificate identity must include device or user attributes stored in Hexnode UEM.
Configure SCEP for iOS Devices in Hexnode UEM
To create an iOS SCEP policy in the Hexnode UEM portal:
- Log in to the Hexnode UEM portal.
- Go to Policies > New Policy > Create a fully custom policy > iOS > Security > SCEP.
- Click Configure.
Configure Microsoft CA (AD CS) SCEP Settings for iOS
Use the following settings when the iOS SCEP policy in Hexnode UEM integrates with a Microsoft CA environment.
| Configuration | Description |
|---|---|
| Server type |
Specify the Microsoft CA hosting environment.
|
| Server URL | The SCEP service URL used to request and receive client certificates. This URL is included in the device profile so the device can obtain certificates. |
| Subject | Enter the X.500 name used to identify the certificate entity, such as C=Country, ST=State, or O=Organization Name. This field supports Hexnode UEM wildcards. |
| Challenge type |
Choose how the device authenticates the SCEP certificate request.
|
| Challenge | This field appears when Microsoft SCEP (mscep) – Password is selected. Enter the password used to authenticate the certificate request. |
| Agent | Select the AD agent that connects to the SCEP server or URL. This setting is required for On-prem CAs to help devices request certificates. If the AD agent is not listed, configure the Hexnode UEM AD agent settings. |
| Challenge URL | This field appears when Microsoft SCEP (mscep) – URL is selected. Enter the CA-provided URL where the device retrieves a one-time challenge password. |
| Username | Enter the username for the SCEP CA. |
| Password | Enter the password for the SCEP CA. |
| Key size | Select 1024 or 2048 bits. The default key size is 1024. |
| Key type | Select the key encryption type. The currently supported key type is RSA. |
| Key used for | Specify whether the key is used for Signing, Encryption, or both, if supported by the CA. |
| Number of automatic retries | Enter the number of retry attempts when the server response is pending. |
| Retry delay (in seconds) | Enter the number of seconds between subsequent retry attempts. |
| Subject Alternative Name | Add alternative identity details such as DNS, Email address, UPN, URI, or SID. This field supports Hexnode UEM wildcards. |
| Upload certificate to extract fingerprint | Upload the CA certificate to extract the fingerprint and verify that the device connects to the intended SCEP server. |
Configure Generic SCEP Settings for iOS Devices
Use the following settings when the iOS SCEP policy in Hexnode UEM integrates with a third-party SCEP-enabled Certificate Authority.
| Configuration | Description |
|---|---|
| Server URL | The SCEP service URL used to request and receive client certificates. |
| Subject | Enter the X.500 name used to identify the certificate entity, such as C=Country or O=Organization. This field supports Hexnode UEM wildcards. |
| Challenge | Enter the SCEP challenge password used to authenticate the certificate request. |
| Key size | Select 1024 or 2048 bits. The default key size is 1024. |
| Key type | Select the key encryption type. The currently supported key type is RSA. |
| Key used for | Specify whether the key is used for Signing, Encryption, or both, if supported by the CA. |
| Number of automatic retries | Enter the number of retry attempts when the server response is pending. |
| Retry delay (in seconds) | Enter the number of seconds between subsequent retry attempts. |
| Subject Alternative Name | Add alternative identity details such as DNS, Email address, UPN, URI, or SID. This field supports Hexnode UEM wildcards. |
| Upload certificate to extract fingerprint | Upload the CA certificate to extract the fingerprint and verify that the device connects to the intended SCEP server. |
Associate and Deploy the iOS SCEP Policy in Hexnode UEM
After configuring the SCEP settings, assign the policy to the required Hexnode UEM targets.
- Navigate to the Policy Targets tab.
- Click +Add Devices.
- Select the target Devices, Users, Device Groups, User Groups, or Domains/OUs.
- Click Save to push the policy.
Troubleshoot SCEP Certificate Deployment for iOS Devices
Use the following checks when a SCEP certificate does not install correctly on an iOS device managed by Hexnode UEM.
Certificate request failed
If the SCEP certificate request fails during deployment, verify that the configured Server URL is reachable from the device network. Also check whether the challenge password configured on the SCEP server has expired or no longer matches the value deployed in the Hexnode UEM policy.
Identity mismatch in the certificate request
If the issued certificate does not contain the expected identity, check that the Subject field uses a valid X.500 format. When Hexnode UEM wildcards are used in the Subject or Subject Alternative Name, verify that the corresponding user or device data is populated in the Hexnode UEM portal.
Certificate request remains pending
If the device remains in a pending state, review the Number of automatic retries and Retry delay (in seconds) values. These settings should give the CA enough time to process the pending certificate request.
Fingerprint validation errors
If a CA certificate fingerprint is provided, it must match the CA certificate exactly. When the fingerprint does not match, the device rejects the connection to the SCEP server.
Frequently Asked Questions
Does Hexnode store the private key?
No. The private key is generated locally on the iOS device and is never sent to the Hexnode portal or the SCEP server.
Can SCEP certificates be used for Wi-Fi or VPN?
Yes. Once the SCEP certificate is successfully deployed to the device, it can be selected as the “Identity Certificate” in Wi-Fi or VPN policies.
Are dynamic SCEP challenges supported?
Hexnode deploys the static challenge provided in the policy. For dynamic challenges, advanced integration with the CA (such as Microsoft NDES) is typically required.
