Onboard macOS devices with certificates using Workspace ONE UEM and SCEP

In this topic, you will learn how to deploy Portnox™ Cloud certificates to macOS devices via Workspace ONE UEM and SCEP.

Turn on the Portnox Cloud SCEP services

In this section, you will configure Portnox™ Cloud to provide SCEP services to your devices.

If you have previously turned on the Portnox Cloud SCEP services, skip to the later steps.

Portnox Cloud SCEP services let devices contact the Cloud SCEP server and get a unique certificate for the device or for the specific user of the device.

In the Cloud portal top menu, click on the Settings option.
In the Cloud portal left-hand side menu, click on the Services > GENERAL SETTINGS > SCEP Services option.
Enable integration with SCEP services.
1. Click on the Edit link.
2. Activate the Enable integration checkbox.
3. Click on the Save button.
Click on the ⧉ icon next to the SCEP URL field to copy the SCEP URL, and paste it in a text file for later use.
Click on the ⧉ icon next to the Password field to copy the SCEP password, and paste it in a text file for later use.

Download the root CA certificate from Portnox Cloud

In this section, you will download the Portnox™ Cloud root CA certificate from the Cloud portal.

You need the root CA certificate so that your managed devices can verify the validity of cloud RADIUS servers, which have certificates signed by this root CA certificate. If the root CA certificate is not distributed to managed devices, some devices may show a security warning each time that the user connects to networks managed by Portnox Cloud.

In the Cloud portal top menu, click on the Settings option.
In the Cloud portal left-hand side menu, click on the Services > CLEAR RADIUS SERVICE > CLEAR RADIUS instance option.

The right-hand pane shows the list of active servers.
Click on any of the active RADIUS services to show its configuration.
Click on the Download root certificate link to download the root CA certificate.

Save the file on your disk to use it later. The default name of the file is rootCertificate.cer.

Create the SCEP CA configuration and the SCEP request template

In this section, you will create the SCEP CA configuration and the SCEP request template in Workspace ONE UEM. This configuration and this template will be used by the profiles that you will create later.

Note: If you already created Workspace ONE UEM profiles for other operating systems, you do not need to create a new SCEP CA configuration. However, you may need to create a new SCEP request template, if you use device-based profiles, and if the device identification for this operating system uses different authentication repository properties than other operating systems.

Open your Workspace ONE UEM tenant dashboard in your browser, and log in as the administrator.
In the left-hand side menu, select: GROUPS & SETTINGS > All Settings.
In the Settings pane, in the left-hand side menu, select: System > Enterprise Integration > Certificate Authorities.
In the Certificate Authorities pane, click on the Add button.
In the Certificate Authority – Add/Edit pane:
1. In the Name field, enter a name for this configuration.
  In this example, we used the name Portnox Cloud SCEP, but you can use any name you like.
2. In the Authority Type field, select the Generic SCEP option.
3. In the SCEP URL field, paste the SCEP URL that you copied earlier from Portnox Cloud.
4. In the Static Challenge and Confirm Challenge Phrase fields, paste the password that you copied earlier from Portnox Cloud.
5. Click on the TEST CONNECTION button to test your configuration.
  You should get a message Test is successful. If you get a message Test is unsuccessful, check your configuration values and also check the status of your Airwatch Cloud Connector – either make sure it is disabled, or enabled and deployed.
6. Click on the SAVE AND ADD TEMPLATE button to save this configuration and proceed to adding a SCEP request template.
In the Certificate Template – Add/Edit pane:
1. In the Name field, type a name for this template.
  In this example, we used the name Portnox Cloud SCEP Template, but you can use any name you like.
2. In the Certificate Authority field, select the name of the SCEP configuration you just created.
3. In the Subject Name field, enter the variables that Workspace ONE UEM will use to fill the Subject name field of the certificate.
  
  The CN= value in the Subject name field of the certificate must match a value from the authentication repository in Portnox Cloud, which uniquely identifies the user or the device. This is the value on the basis of which the Portnox Cloud SCEP server will know for which user or device it should issue a certificate.
  
  Note: Click on the + symbol to show a list of variables that you can use.
  
  In this example, we used the format CN={EmailAddress}, which generates the subject name on the basis of the user’s email address and is the recommended value for user-based SCEP certificates in Portnox Cloud.
4. In the Private Key Length field, we recommend that you select the 2048 option.
  
  Note: If you’re likely to experience network packet fragmentation due to the structure of your network, for example, due to firewalls, choose 1024 instead to prevent issues due to fragmentation. If such problems occur, see the following topic: Certificate fragmentation issues.
5. In the Private Key Type field, select both checkboxes.
6. In the Automatic Certificate Renewal field, we recommend that you select the ENABLED option and in the Publish Private Key field, we recommend that you select the DISABLED option.
  These values will not directly affect the integration. They apply to your certificate renewal management and security preferences. Adjust them to your needs, if necessary.
7. Click on the SAVE button to save the template.

Result: You created a configuration for the Portnox Cloud SCEP CA and the SCEP request template.

Create a profile for macOS

In this section, you will create a profile in Workspace ONE UEM for macOS devices. This profile will contain the necessary certificates as well as SCEP, Wi-Fi, and Ethernet configurations.

In the left-hand side menu, select: RESOURCES > Profiles & Baselines > Profiles.
In the Profiles pane, click on the Add button and select the Add Profile option.
In the Add Profile pane, click on the Apple macOS icon.
In the Select Context pane, click on the User icon.
In the General tab, in the Name field, enter a name for the profile and configure other options as required by your organization policies.

Note: In the Smart Groups field, make sure to select the correct group to push this profile to correct devices.

In this example, we used the name Portnox Cloud macOS Profile, but you can use any name you like.
In the left-hand side menu, click on the SCEP option, and then click on the Configure button in the right-hand side pane.
In the SCEP pane:
1. In the Credential Source field, select the Defined Certificate Authority option.
2. In the Certificate Authority field, select the name of the SCEP CA configuration you created earlier.
3. In the Certificate Template field, select the name of the SCEP request template you created earlier.
4. Deactivate the Allow export of private key from Keychain checkbox.
In the left-hand side menu, click on the Credentials option, and then click on the Configure button in the right-hand side pane.
In the Credentials pane, configure the following payload:
1. In the Credential Source field, select the Upload option.
2. In the Certificate section, click on the UPLOAD button and select the root CA certificate file that you downloaded earlier.
3. Deactivate the Allow export of private key from Keychain checkbox.
In the left-hand side menu, click on the Network option, and then click on the Configure button in the right-hand side pane.
In the Network pane:
1. In the Network Interface field, select the Wi-Fi value.
2. In the Service Set Identifier field, enter the SSID of your Wi-Fi network.
3. In the Security Type field, select the WPA2 Enterprise option.
4. Optional: Activate the Prevent MAC address randomization checkbox to improve monitoring.
5. In the Protocols section, activate the EAP-TLS checkbox.
6. In the Identity Certificate field, select the SCEP #1 option.
7. In the Trusted Certificates section, activate the Certificate #1 checkbox.
8. Optional: Deactivate the Allow Trust Exceptions field to improve security.
Optional: Click on the + icon in the bottom-right corner of the Network pane to add another network payload, and then configure the 802.1X Ethernet payload:

Note: Depending on your hardware configurations, you can choose a different 802.1X Ethernet payload. The setup procedure is almost the same for all 802.1X payloads. You can repeat this step as many times as needed to cover all hardware configurations.
1. In the Network Interface field, select the value relevant to your hardware configuration, for example, First Active Ethernet.
2. In the Protocols section, activate the EAP-TLS checkbox.
3. In the Identity Certificate field, select the SCEP #1 option.
4. In the Trusted Certificates section, activate the Certificate #1 checkbox.
5. Optional: Deactivate the Allow Trust Exceptions field to improve security.
In the bottom-right corner of the Add a New Apple macOS Profile pane, click on the SAVE AND PUBLISH button.
In the View Device Assignment window, confirm if the profile will be pushed to correct devices, and then click on the PUBLISH button.

Result: You created a profile for Portnox Cloud and macOS devices.

After you created your profile, you can use your regular Workspace ONE UEM procedures to push it to managed computers immediately and see if it works correctly. For information on managing computers, pushing profiles, and troubleshooting, consult the Workspace ONE UEM documentation.