To add a SCEP device policy for iOS

To add a SCEP device policy for iOS

This policy allows you to configure iOS devices to retrieve a certificate using Simple Certificate Enrollment Protocol (SCEP) from an external SCEP server. If you want to deliver a certificate to the device using SCEP from a PKI that is connected to XenMobile, you should create a PKI entity and a PKI provider in distributed mode. For details, see PKI Entities.

1. In the XenMobile console, click Configure > Device Policies.

The Device Policies page appears.

2. Click Add.

The Add a New Policy page appears.

3. On the Add a New Policy page, click More and then under Security, click SCEP.

The SCEP Policy information page appears.

4. In the Policy Information pane, enter the following information:

a. Policy Name: Type a descriptive name for the policy.

b. Description: Optionally, type a description for the policy.

5. Click Next.

The iOS Platform Information page appears.

6. On the iOS Platform Information page, enter the following information:

a. URL base: Type the address of the SCEP server to define where SCEP requests are sent, over HTTP or HTTPS. The private key isn’t sent with the Certificate Signing Request CSR), so it may be safe to send the request unencrypted. If, however, the one-time password is allowed to be reused, you should use HTTPS to protect the password. This step is required.

b. Instance name: Type any string that the SCEP server recognizes. For example, it could be a domain name like example.org. If a CA has multiple CA certificates, you can use this field to distinguish the required domain. This step is required.

c. Subject X.500 name (RFC 2253): Type the representation of a X.500 name represented as an array of Object Identifier (OID) and value. For example, /C=US/O=Apple Inc./CN=foo/1.2.5.3=bar, which would translate to: [ [ ["C", "US"] ], [ ["O", "Apple Inc."] ], ..., [ ["1.2.5.3", "bar" ] ] ]. You can represent OIDs as dotted numbers with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).

d. Subject alternative names type: In the list, click an alternative name type. The SCEP policy can specify an optional alternative name type that provides values required by the CA for issuing a certificate. You can specify None, RFC 822 name, DNS name, or URI.

e. Maximum retries: Type the number of retries allowed when a user enters an incorrect password. The default is 3.

f. Retry delay: Type a time interval after which users exceed the maximum number of retries and a lockout is enforced. The default is 10.

g. Challenge password: Enter a pre-shared secret. This step is required.

h. Key size (bits): In the list, click the key size in bits, either 1024 or 2048. The default is 1024.

i. Use as digital signature: Specify whether you want the certificate to be used as a digital signature. If someone is using the certificate to verify a digital signature, such as verifying whether a certificate was issued by a CA, the SCEP server would verify that the certificate can be used in this manner prior to using the public key to decrypt the hash.

j. Use for key encipherment: Specify whether you want the certificate to be used for key encipherment. If a server is using the public key in a certificate provided by a client to verify that a piece of data was encrypted using the private key, the server would first check to see whether the certificate can be used for key encipherment. If not, the operation fails.

k. SHA1/MD5 fingerprint (hexadecimal string): If your CA uses HTTP, use this field to provide the fingerprint of the CA certificate, which the device uses to confirm authenticity of the CA response during enrollment. You can enter a SHA1 or MD5 fingerprint, or you can select a certificate to import its signature.

7. Under Policy Settings, next to Remove policy, click either Select date or Duration until removal (in days).

8. If you click Select date, click the calendar to select the specific date for removal.

9. In the Allow user to remove policy list, click Always, Password required, or Never.

10. If you click Password required, next to Removal password, type the necessary password.

11. Expand Deployment Rules and then configure the following settings: The Base tab appears by default.

a. In the lists, click options to determine when the policy should be deployed.

i. You can choose to deploy the policy when all conditions are met or when any conditions are met. The default option is All.

ii. Click New Rule to define the conditions.

iii. In the lists, click the conditions, such as Device ownership and BYOD, as shown in the preceding figure.

vi. Click New Rule again if you want to add more conditions. You can add as many conditions as you

would like.

b. Click the Advanced tab to combine the rules with Boolean options.

 The conditions you chose on the Base tab appear.

c. You can use more advanced Boolean logic to combine, edit, or add rules.

i. Click AND, OR, or NOT.

ii. In the lists that appear, choose the conditions that you want to add to the rule and then click the Plus sign (+) on the right-hand side to add the condition to the rule.

At any time, you can click to select a condition and then click EDIT to change the condition or Delete to remove the condition.

iii. Click New Rule again if you want to add more conditions.

In this example, the device ownership must be BYOD, the device local encryption must be True, and the device mobile country code cannot be only Andorra.

12. Click Next. The SCEP Policy assignment page appears.

13. Next to Choose delivery groups, type to find a delivery group or select a group or groups in the list to which you want to assign the policy. The groups you select appear in the right-hand Delivery groups to receive app assignment list.

14. Expand Deployment Schedule and then configure the following settings:

a. Next to Deploy, click ON to schedule deployment or click OFF to prevent deployment. The default option is ON. If you choose OFF, no other options need to be configured.

b. Next to Deployment schedule, click Now or Later. The default option is Now.

c. If you click Later, click the calendar icon and then select the date and time for deployment.

d. Next to Deployment condition, click On every connection or click Only when previous deployment has failed. The default option is On every connection.

e. Next to Deploy for always-on connection, click ON or OFF. The default option is OFF.

15. Click Save to save the policy.