Certificate Enrollment settings

Identity certificates can be distributed via Apps@Work.

Certificate enrollment settings are used as follows:

  • As part of a larger process of setting up a certificate enrollment server to support authentication for VPN on demand, Wi-Fi, Exchange ActiveSync, AppTunnel and so on.
  • To provide devices identity certificates that you uploaded to Core for the case when you want to provide the same identity certificate to many users’ devices.
  • To provide user-provided certificates to devices when end users use the Core user portal to upload their identity certificates to Core.

The available options are:

  • Blue Coat: Select Blue Coat to create a Blue Coat certificate enrollment setting for integrating with the Blue Coat Mobile Device Security service.
  • Client-Provided: Select Client-Provided if you want AppConnect apps to use derived credentials for authentication, digital signing, or encryption.
  • Entrust: Select Entrust if you are using the Entrust Datacard certificate enrollment solution.
  • GlobalSign: Select GlobalSign if you are using GlobalSign as the CA for certificate enrollment.
  • Local: Select Local if you are using Core as the CA.
  • OpenTrust: Select OpenTrust if you are using the OpenTrust integration. See Configuring OpenTrust CA.
  • Single File Identity: Select Single File Identity to upload an identity certificate for distribution to devices.

  • SCEP: Select SCEP for standard certificate-based authentication using a separate CA.

    SCEP Configurations created before upgrading to Core 7.0.0.0 or later should be replaced with a new SCEP Configuration. Failure to do so might result in cert renewal failure from Core 9.4.0.0.

  • Symantec Managed PKI: Select Symantec Managed PKI if you are using Symantec’s Certificate Enrollment solution. See Configuring Symantec Managed PKI for more information.
  • Symantec Web Services Managed PKI: Select Symantec Web Services Managed PKI if you are using the Symantec Web Services Managed PKI solution. See Configuring Symantec Web Services Managed PKI for more information.
  • User-Provided: Select User-Provided if device users will upload their personal certificates. The user portal includes a certificate upload section for this purpose. A web services API is also available for you to upload user-provided certificates.

If Certificate Enrollment integration is not an option

If Certificate Enrollment integration is not an option for your organization, consider configuring Core as an intermediate or root CA. See Certificate Enrollment settings for more information.

Supported variables for certificate enrollment

The following variables are supported for the required and optional fields when configuring integration with supported Certificate Authorities (CA’s):

  • $EMAIL$
  • $USERID$
  • $FIRST_NAME$
  • $LAST_NAME$
  • $DISPLAY_NAME$
  • $USER_DN$
  • $USER_UPN$
  • $USER_LOCALE$
  • $DEVICE_UUID$
  • $DEVICE_UUID_NO_DASHES$
  • $DEVICE_UDID$
  • $DEVICE_IMSI$
  • $DEVICE_IMEI$
  • $DEVICE_SN$
  • $DEVICE_ID$
  • $DEVICE_MAC$
  • $DEVICE_CLIENT_ID$
  • $USER_CUSTOM1$
  • $USER_CUSTOM2$
  • $USER_CUSTOM3$
  • $USER_CUSTOM4$
  • $REALM$
  • $TIMESTAMP_MS$
  • $RANDOM_16$
  • $RANDOM_32$
  • $RANDOM_64$
  • $CONFIG_UUID$*

* This substitution variable works only for the values under the Subject Alternative Names section for the following configurations: Entrust, Local, SCEP, Symantec Managed KPI. It is used for Sentry certificate-based tunneling (CBT).