Onboard iOS devices with certificates using Microsoft Intune and SCEP

In this topic, you will learn how to deploy Portnox™ Cloud certificates to iOS devices via Microsoft Intune SCEP.

Important: Before you can deploy Portnox Cloud certificates via Intune SCEP, you must activate the integration between Portnox Cloud and Microsoft Intune.

Turn on the Portnox Cloud SCEP services

In this section, you will configure Portnox™ Cloud to provide SCEP services to your devices.

If you have previously turned on the Portnox Cloud SCEP services, skip to the step in which you get the Cloud SCEP URL for Microsoft Intune.

Portnox Cloud SCEP services let devices contact the Cloud SCEP server and get a unique certificate for the device or for the specific user of the device.

In the Cloud portal top menu, click on the Settings option.
In the right-hand side pane, find and click on the CLEAR GENERAL SETTINGS heading.

More options appear under the CLEAR GENERAL SETTINGS heading and description.
Enable integration with SCEP services.
1. Scroll down to the SCEP SERVICES section.
2. Click on the Edit link.
3. Activate the Enable integration checkbox.
4. Click on the Save button.
Click on the ⧉ icon next to the SCEP URL for MS Intune field to copy the SCEP URL, and paste it in a text file for later use.

Download the root CA certificate from Portnox Cloud

In this section, you will download the Portnox™ Cloud root CA certificate from the Cloud portal.

You need the root CA certificate so that your managed devices can verify the validity of cloud RADIUS servers, which have certificates signed by this root CA certificate. If the root CA certificate is not distributed to managed devices, some devices may show a security warning each time that the user connects to networks managed by Portnox Cloud.

In the Cloud portal top menu, click on the Settings option.
In the right-hand side pane, find and click on the CLEAR RADIUS SERVICE heading.

The active servers appear under the CLEAR RADIUS SERVICE heading and description along with advanced options.
Click on any of the active RADIUS services to show its configuration.
Click on the Download root certificate link to download the root CA certificate.

Save the file on your disk to use it later. The default name of the file is rootCertificate.cer.

Download the tenant CA certificate from Portnox Cloud

In this section, you will download the Portnox™ Cloud tenant CA certificate from the Cloud portal and convert it to the Base-64 encoded X.509 format.

You need the tenant CA certificate from Portnox Cloud so that your managed devices can verify the validity of individual SCEP certificates, which are signed using the tenant CA certificate.

In the Cloud portal top menu, click on the Settings option.
In the right-hand side pane, find and click on the CLEAR GENERAL SETTINGS heading.

More options appear under the CLEAR GENERAL SETTINGS heading and description.
Scroll down to the TRUSTED ROOT CERTIFICATES section and click on the Download link, then save the downloaded file.

The default name of the file is Your_tenant_name - Portnox CLEAR.pfx, for example, Portnox - Portnox CLEAR.pfx.
In Windows, right-click on the downloaded file and select Open from the context menu.

The file will be opened in the Windows certificate manager.
In the certificate manager window, open the Certificates section in the left-hand pane and then double-click on Portnox - Portnox CLEAR in the right-hand side pane.
In the Certificate window, click on the Details tab and then click on the Copy to File button.
In the Certificate Export Wizard, export the certificate in base-64 encoded format.
1. In the first step of the wizard, click on the Next button.
2. In the second step of the wizard, select the Base-64 encoded X.509 (.CER) option.
3. In the third step of the wizard, select a file to save the exported tenant CA certificate, and click on the Next button.
  For example, save the file as tenantCertificate.cer.
4. In the last step of the wizard, click on the Finish button. Then, close the Certificate window.

Create a profile for the root CA certificate

In this section, you will create a profile in Microsoft Intune for the downloaded Portnox™ Cloud root CA certificate.

Open the Microsoft Intune portal in your browser: intune.microsoft.com.
In the left-hand menu, select the Devices option.
In the left-hand menu of the Devices pane, select the Configuration option.
In the Devices | Configuration pane, in the Policies tab, click on the Create button and select the New Policy option.
In the Create a profile pane:
1. In the Platform field, select iOS/iPadOS.
2. In the Profile type field, select Templates
3. In the search bar, type trusted.
4. In the Template name field, click on the Trusted certificate option.
5. Click on the Create button.
In the Basics step of the Trusted certificate wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

In this example, we used the name Portnox Cloud root CA iOS, but you can use any name you like.
In the Configuration settings step of the wizard, click on the 🗀 icon to open the downloaded root CA file and click on the Next button.

In this example, the file has the default name rootCertificate.cer.
In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.
In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a trusted certificate profile for the Portnox Cloud root CA certificate.

Create a profile for the tenant CA certificate

In this section, you will create a profile in Microsoft Intune for the downloaded Portnox™ Cloud tenant CA certificate.

Open the Microsoft Intune portal in your browser: intune.microsoft.com.
In the left-hand menu, select the Devices option.
In the left-hand menu of the Devices pane, select the Configuration option.
In the Devices | Configuration pane, in the Policies tab, click on the Create button and select the New Policy option.
In the Create a profile pane:
1. In the Platform field, select iOS/iPadOS.
2. In the Profile type field, select Templates
3. In the search bar, type trusted.
4. In the Template name field, click on the Trusted certificate option.
5. Click on the Create button.
In the Basics step of the Trusted certificate wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

In this example, we used the name Portnox Cloud tenant CA iOS, but you can use any name you like.
In the Configuration settings step of the Trusted certificates wizard, click on the 🗀 icon to open the downloaded and converted tenant CA file and click on the Next button.

In this example, the file has the name tenantCertificate.cer.
In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.
In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a trusted certificate profile for the Portnox Cloud tenant CA certificate.

Create a profile for SCEP device certificates

In this section, you will create a profile in Microsoft Intune for unique device certificates, which are generated by Portnox™ Cloud for the devices, and obtained through SCEP requests.

You need to complete this task only if you have iOS devices enrolled using device enrollment. If you want to use only devices enrolled using user enrollment, complete the next task instead.

Open the Microsoft Intune portal in your browser: intune.microsoft.com.
In the left-hand menu, select the Devices option.
In the left-hand menu of the Devices pane, select the Configuration option.
In the Devices | Configuration pane, in the Policies tab, click on the Create button and select the New Policy option.
In the Create a profile pane:
1. In the Platform field, select iOS/iPadOS.
2. In the Profile type field, select Templates
3. In the search bar, type scep.
4. In the Template name field, click on the SCEP certificate option.
5. Click on the Create button.
In the Basics step of the SCEP certificate wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

In this example, we used the name Portnox Cloud SCEP Device iOS, but you can use any name you like.
In the Configuration settings step of the SCEP certificates wizard, fill in the fields as follows, and then click on the Next button.
Adjust the proposed values to your requirements and your environment, if needed.
1. In the Certificate type field, select Device.
2. In the Subject name format field, enter the variables that Intune will use to fill the Subject name field of the certificate.
  
  For information on variables that you can use, consult Intune documentation.
  
  In this example, we used the format CN={{DeviceId}}, which generates the subject name on the basis of the device ID. This is the value that you should use. Otherwise, Cloud will be unable to recognize the devices, and instead of mapping them to device accounts from the authentication repository, it will create new Cloud accounts for them.
3. In the Subject alternative name section, select the attributes and the values that Intune will use to fill the SAN fields of the certificate.
  
  For information on attributes and values that you can use, consult Intune documentation.
  
  In this example, we used the attribute URI with the value https://intunedeviceid/{{DeviceId}}, which is the recommended value.
4. In the Key usage field, select both available values.
5. In the Key size (bits) field, we recommend that you select the 2048 option.
  
  Note: If you’re likely to experience network packet fragmentation due to the structure of your network, for example, due to firewalls, choose 1024 instead to prevent issues due to fragmentation. If such problems occur, see the following topic: Certificate fragmentation issues.
6. In the Root Certificate section, click on the Root Certificate link and select the tenant CA certificate profile that you created in the earlier task.
  
  Note: Do not select the root CA certificate here. The root CA certificate is used in the network profile to confirm the identity of the cloud RADIUS servers.
7. In the Extended key usage section, in the Predefined values column, select the Client Authentication option.
8. In the SCEP Server URLs section, copy and paste the SCEP URL that you saved in the first task in this series.
9. For other fields, leave the default values or adjust values to your requirements and your environment, if needed.
In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.
In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a profile for device certificates obtained through SCEP.

Create a profile for SCEP user certificates

In this section, you will create a profile in Microsoft Intune for unique user certificates, which are generated by Portnox™ Cloud for the users of devices, and obtained through SCEP requests.

You need to complete this task only if you have iOS devices enrolled using user enrollment. If you want to use only devices enrolled using device enrollment, complete the previous task instead.

Open the Microsoft Intune portal in your browser: intune.microsoft.com.
In the left-hand menu, select the Devices option.
In the left-hand menu of the Devices pane, select the Configuration option.
In the Devices | Configuration pane, in the Policies tab, click on the Create button and select the New Policy option.
In the Create a profile pane:
1. In the Platform field, select iOS/iPadOS.
2. In the Profile type field, select Templates
3. In the search bar, type scep.
4. In the Template name field, click on the SCEP certificate option.
5. Click on the Create button.
In the Basics step of the SCEP certificate wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

In this example, we used the name Portnox Cloud SCEP User iOS, but you can use any name you like.
In the Configuration settings step of the SCEP certificates wizard, fill in the fields as follows, and then click on the Next button.
Adjust the proposed values to your requirements and your environment, if needed.
1. In the Certificate type field, select User.
2. In the Subject name format field, enter the variables that Intune will use to fill the Subject name field of the certificate.
  
  For information on variables that you can use, consult Intune documentation.
  
  In this example, we used the format CN={{UserPrincipalName}}, which generates the subject name on the basis of the user’s principal name.
3. In the Subject alternative name section, select the attributes and the values that Intune will use to fill the SAN fields of the certificate.
  
  For information on attributes and values that you can use, consult Intune documentation.
  
  In this example, we used the attribute URI with the value https://intunedeviceid/{{DeviceId}}, and the attribute User principal name (UPN) with the value {{UserPrincipalName}}.
  
  Note: By default, Portnox Cloud checks for user identity information in the SAN UPN field. You can use a different SAN field, but it is not recommended. For more information, see the following topic: Certificate identity information.
4. In the Key usage field, select both available values.
5. In the Key size (bits) field, we recommend that you select the 2048 option.
  
  Note: If you’re likely to experience network packet fragmentation due to the structure of your network, for example, due to firewalls, choose 1024 instead to prevent issues due to fragmentation. If such problems occur, see the following topic: Certificate fragmentation issues.
6. In the Root Certificate section, click on the Root Certificate link and select the tenant CA certificate profile that you created in the earlier task.
  
  Note: Do not select the root CA certificate here. The root CA certificate is used in the network profile to confirm the identity of the cloud RADIUS servers.
7. In the Extended key usage section, in the Predefined values column, select the Client Authentication option.
8. In the SCEP Server URLs section, copy and paste the SCEP URL that you saved in the first task in this series.
9. For other fields, leave the default values or adjust values to your requirements and your environment, if needed.
In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.
In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a profile for user certificates obtained through SCEP.

Create a profile for Wi-Fi managed by Portnox Cloud

In this section, you will create a profile in Microsoft Intune for the connection of devices to the Wi-Fi network managed by Portnox™ Cloud.

Open the Microsoft Intune portal in your browser: intune.microsoft.com.
In the left-hand menu, select the Devices option.
In the left-hand menu of the Devices pane, select the Configuration option.
In the Devices | Configuration pane, in the Policies tab, click on the Create button and select the New Policy option.
In the Create a profile pane:
1. In the Platform field, select iOS/iPadOS.
2. In the Profile type field, select Templates
3. In the search bar, type wi-fi.
4. In the Template name field, click on the Wi-Fi option.
5. Click on the Create button.
In the Basics step of the Wi-Fi wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

In this example, we used the name Portnox Cloud Wi-Fi iOS, but you can use any name you like.
In the Configuration settings step of the wizard, in the Wi-Fi type field, select the Enterprise option, fill in the following fields, and then click on the Next button.

Adjust the proposed values to your requirements and your environment, if needed.
1. In the Network name field, enter a friendly name for this connection, and in the SSID field, enter the SSID of the Wi-Fi network managed by Portnox Cloud.
  
  The Network name is the name users see when they browse the available connections on their device.
2. In the Security type field, select the WPA/WPA2-Enterprise option.
3. In the EAP type field, select the EAP-TLS option.
4. In the Certificate server names field, type clear-rad.portnox.com.
  
  Note: To learn more about this option, read the following topic: Trusted certificate server names.
5. In the Root certificate for server validation section, click on the Select a certificate profile link and select the root CA profile you created in the earlier task.
  
  Note: This root certificate is used to validate the RADIUS server. Do not select the tenant CA certificate here. The tenant CA certificate is used in SCEP profiles to verify the validity of SCEP certificates.
6. In the Client Authentication section, in the Authentication method field, select the Certificates option.
7. In the Certificates section below, click on the Certificates link and select the profiles you created earlier: the device profile or the user profile.
  
  Important: You can only select one authentication profile for the Wi-Fi network, so if you need to authenticate both user devices and dedicated devices, you need to use two different SSIDs and two Wi-Fi configurations.
8. For other fields, leave the default values or adjust values to your requirements and your environment, if needed.
In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.
In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a profile for iOS devices and the Wi-Fi network managed by Portnox Cloud.