Chapter 4 Infrastructure and integration 33
The list of supported certicate and identity formats on Apple devices are:
•
X.509 certicates with RSA keys
•
Certicate: .cer, .crt, .der
•
Identity: .pfx, .p12
Deploy certicates to establish trust with Certication Authorities (CA) that are not trusted by
default (such as an organizational-issuing certication authority).
Distribute and install certicates
Manually distributing certicates to iOS devices is simple. When a certicate is received,
users simply tap to review the contents, then tap to add the certicate to their device.
When an identity certicate is installed, users are prompted for the password that protects it.
If a certicate’s authenticity can’t be veried, it’s shown as untrusted and the user can decide
whether to add it to their device.
Install certicates using conguration proles
If conguration proles are being used to distribute settings for corporate services such as
S/MIME mail, VPN, or Wi-Fi, certicates can be added to the prole to streamline deployment.
This includes the ability to distribute certicates with MDM.
Install certicates via Mail or Safari
If a certicate is sent in a mail message, it appears as an attachment. Safari can also be used
to download certicates from a webpage. You can host a certicate on a secured website and
provide users with the URL where they can download the certicate onto their Apple device.
Certicate removal and revocation
To manually remove a certicate that’s been installed, choose Settings > General > Device
Management, select a prole, choose More Details, and choose the appropriate certicate to
remove. If a user removes a certicate that’s required for accessing an account or network, the
iOS device is no longer able to connect to those services.
An MDM server can view all certicates on a device and remove any certicates it has installed.
Additionally, the Online Certicate Status Protocol (OCSP) and CRL (Certicate Revocation List)
protocol are supported to check the status of certicates. When an OCSP- or CRL-enabled
certicate is used, both iOS and OS X periodically validate it to make sure that it hasn’t
been revoked.
Single Sign-On (SSO)
Single Sign-On (SSO) is a process in which a user can provide authentication information once,
receive a ticket, and use it to access resources for as long as the ticket is valid. This strategy
makes it possible to maintain secure access to resources without the system prompting the
user for credentials every time access is requested. It also increases the security of daily app use,
by ensuring that passwords are never transmitted over the network.
100% resize factor
