Certificates overview

Ivanti EPMM is capable of distributing and managing certificates. Certificates are mainly used for the following purposes:

• Establishing secure communications
• Encrypting payloads
• Authenticating users and devices

Certificates establish user identity while eliminating the need for users to enter user names and passwords on their mobile devices. Certificates streamline authentication to key enterprise resources, such as email, Wi-Fi, and VPN. Some applications require the use of certificates for authentication.

Ivanti recommends to allow HTTPS traffic on port 8443 from the corporate network, limited to Ivanti applications only. This service is intended for EPMM server management and must have strictly controlled access.

The following diagram compares a certificate to a passport:

Figure 1. Comparing certificates to a passport

The certificate includes information that identifies the following information:

• The issuing certificate authority
• Acceptable uses for the certificate
• Information that enables the certificate to be validated.

This solution provides the flexibility to use Ivanti EPMM as a local certificate authority, an intermediate certificate authority, or as a proxy for a trusted certificate authority.

Types of certificates

Ivanti EPMM uses the following types of certificates:

Table 72.  Certificate types

Certificate type	Description
Portal HTTPS	The identify certificate and its certificate chain, including the private key, that identifies Ivanti EPMM, allowing a client (such as a browser or app) to trust Ivanti EPMM. Typically, this certificate is the same certificate as the Client TLS and iOS Enrollment certificates. Ivanti EPMM sends this certificate to the client as part of the TLS handshake over port 443 or 8443 when the client initiates a request to Ivanti EPMM. This certificate must be a publicly trusted certificate from a well-known Certificate Authority if you are using mutual authentication. Related topics  “Certificates you configure on the System Manager” in the Ivanti EPMM System Manager Guide.
Client TLS	The identify certificate and its certificate chain, including the private key, that identifies Ivanti EPMM, allowing Ivanti Mobile@Work for iOS and Android to trust Ivanti EPMM. Typically, this certificate is the same certificate as the Portal HTTPS and iOS Enrollment certificates. Ivanti EPMM sends this certificate to Ivanti Mobile@Work for iOS or Android as part of the TLS handshake over port 9997 when Ivanti Mobile@Work initiates a request to Ivanti EPMM. Related topics  “Certificates you configure on the System Manager” in the Ivanti EPMM System Manager Guide.
Ivanti EPMM server SSL	Can be either self-signed or third-party certificates. By default, Ivanti EPMM generates self-signed certificates. You can use trusted certificates from third-party certificate providers such as Verisign, Thawte, or Go Daddy. Kerberos and Entrust certificates are also supported.
Sentry server SSL	Identifies the Sentry to the client and secures communication, over port 443, between devices and the Sentry.
Windows Phone Enrollment	Issued by Ivanti EPMM to authenticate the device. This is the local CA certificate.
Client identity	Verifies the identity of users and devices and can be distributed through Certificate Enrollment.

Windows devices require a root or intermediate certificate from a trusted certificate authority (CA) for registering with Ivanti EPMM.