Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-2709: How to Setup Auto-provisioning of Computer Certificates to iOS Devices

App Access Service ,  

28 October,13 at 12:48 PM

Applies to: DirectControl for Mobile 1.0.2




Does Centrify provide a method to setup and configure auto-provisioning of computer certificates for strong authentication to wireless enterprise networks (EPA-TLS, WPA and WPA2) for iOS devices?




The Centrify cloud proxy does include this feature. The computer certificate template used for mobile deployment has a specific naming requirement and must be named Computer-ClientAuth to be recognized by the Centrify proxy.


Known Issues:

· Cloud Proxy server needs to be installed on Windows Server 2008 R2

· Long usernames or iOS device names can cause certificate delivery errors

· iOS device name with invalid computer account characters (,~:!@#$%^&*.(){}_’) can cause certificate delivery errors

· Currently not supported for Android – iOS devices only


To create the auto-enroll certificate template for deployment to iOS:


1. Open mmc on the CA in your environment and add the Certification Authority snap-in

2. Select the Certificate Templates folder and choose Manage from the actions pane (or right-click the folder and select Manage)

3. Create a new template – right-click the “Computer” template and choose Duplicate

4. Set template name to “Computer-ClientAuth” (no quotes) – this is the specific certificate name the proxy will look to issue

5. Under Subject Name tab, select option “Supply in the request”

6. On Security tab, set Authenticated Users and Domain Computers to have Enroll permissions

7. Go back to the Certificate Templates folder and right-click, choose New > Certificate Template to Issue – add the new Computer-ClientAuth template

8. To issue the new certificate, create a Wi-Fi mobile policy and select any WPA security type and TLS as the EAP protocol


Please see article KB-4283: Creating templates to use certificates for authentication for complete step-by-step instructions to create templates used for certificate authentication


Certificate Template Example: