Does Jamf Pro support certificate enrollment and device attestation?

Management platform · enrollment perspective

Jamf Pro is Jamf's device management service for Apple devices (macOS, iOS, iPadOS, tvOS, visionOS). It issues the MDM device identity certificate from a built-in certificate authority or a SCEP-enabled external CA, and delivers configuration profile certificates through SCEP (including Jamf Pro acting as SCEP proxy), the Jamf AD CS Connector, and the Apple ACME Certificate payload.

Vendor: Jamf
Published workflows: 17
Verified: 2026-10-29

Workflows selected by managing platform ID; signed issuers remain distinct · Evidence and conditions are shown per workflow

Wi-Fi EAP-TLS

12 workflows

Jamf Pro: Wi-Fi EAP-TLS workflows · enrollment management and issuing CA shown separately
Workflow	Signed issuer	Managing platform	Key protection	Attestation evidence	Status
macOS · SCEP profileWi-Fi EAP-TLS · native MDM enrollment	Active Directory Certificate Services	Jamf Pro	not documented by the vendor	none (documented absence)	supportedVerified 2026-10-29
Requirements, limitations and evidence 6 cited claims Workflow reference: `wf-jamf-pro-macos-wifi-scep-adcs-connector` On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose Wi-Fi EAP-TLS Enrollment method SCEP profile Enrollment service native MDM enrollment Issuer type AD CS Key protection not documented by the vendor Attestation evidence none (documented absence) Verification type vendor documented Prerequisites Jamf AD CS Connector installed (inbound or outbound communication mode); AD CS configured as a certificate authority in Jamf Pro; SCEP payload with Certificate Authority Type AD CS. Outbound mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later. Redistribute Profile adds $PROFILE_IDENTIFIER to the Subject, which is limited to 64 characters. Notes and documented limits With the SCEP payload, traffic flows through Jamf Pro and then to AD CS by way of the Jamf AD CS Connector. Jamf also documents a Certificate payload path with the connector; that path is not filed here. The enrollment_service enum has no value for the Jamf AD CS Connector, so mdm_native is used with this variant label. Key protection is not documented by Jamf or Apple for SCEP-issued identities. Evidence for wf-jamf-pro-macos-wifi-scep-adcs-connector (6 claims) Jamf documents that the connector's outbound communication mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later. vendor_documented Evidence status: supported Outbound mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later.Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Jamf AD CS Connector Communication Modes macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector in outbound mode (mdm_native); Active Directory Certificate Services Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that the Jamf AD CS Connector can be configured in Jamf Pro using either the SCEP payload or the Certificate payload. vendor_documented Evidence status: supported The Jamf AD CS Connector can be configured in Jamf Pro using either the SCEP or Certificate payload.Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Overview (integration methods list) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that SCEP payload certificate traffic flows through Jamf Pro and then to AD CS when the AD CS integration is used. vendor_documented Evidence status: supported When certificates are distributed using the SCEP payload, traffic flows through Jamf Pro and then to AD CS.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (introduction) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents distributing AD CS certificates to computers and mobile devices through configuration profiles once Jamf Pro and AD CS communicate through the connector. vendor_documented Evidence status: supported After communication between Jamf Pro and AD CS has been established, you can use Jamf Pro to distribute certificates with AD CS as the certificate authority to computers and mobile devices in your environment using configuration profiles.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (introduction) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents a Redistribute Profile option on the SCEP payload with AD CS that redistributes the profile a chosen number of days before the certificate expires, which places renewal with Jamf Pro. vendor_documented Evidence status: supported (Optional) If you want the configuration profile to be redistributed to devices before the certificate expires, select the number of days before the expiration date that you want from the Redistribute Profile pop-up menu.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (step 9) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation. vendor_documented Evidence status: supported Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
macOS · SCEP profileWi-Fi EAP-TLS · SCEP gateway	Smallstep	Jamf Pro	not documented by the vendor	not documented by the vendor	supportedVerified 2026-10-29
Requirements, limitations and evidence 9 cited claims Workflow reference: `wf-smallstep-jamf-macos-wifi-scep` On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose Wi-Fi EAP-TLS Enrollment method SCEP profile Enrollment service SCEP gateway Issuer type third-party CA Key protection not documented by the vendor Attestation evidence not documented by the vendor Verification type vendor documented Prerequisites Jamf Pro connected to Smallstep; SCEP Challenge webhook configured in Jamf with the SCEPChallenge event; device already enrolled with a basic Jamf MDM profile; Device or Computer Level profile, not User Level; no Jamf SCEP proxy needed because the hosted CA is reachable from the public internet. Notes and documented limits Agentless SCEP path. The page does not state key protection, attestation or renewal for the SCEP path; it contrasts SCEP with the ACME-DA path, whose key is hardware-bound. The older Jamf setup guide covers the same SCEP workflow. Evidence for wf-smallstep-jamf-macos-wifi-scep (9 claims) The Smallstep Agent is not required on the device in the Jamf SCEP path. vendor_documented Evidence status: supported The Smallstep Agent is not required on the device.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS and iOS with Jamf Pro (SCEP) macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf deploys a profile that establishes CA trust, obtains a client certificate from the Smallstep SCEP server with dynamic single-use challenges, and configures Wi-Fi. vendor_documented Evidence status: supported In this workflow, Jamf deploys a configuration profile that establishes CA trust, gets a client certificate via Smallstep's SCEP server (using dynamic, single-use challenges), and configures the Wi-Fi network.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS and iOS with Jamf Pro (SCEP) macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. No Jamf SCEP proxy is needed because the Smallstep hosted CA is reachable from the public internet. vendor_documented Evidence status: supported Because your Smallstep hosted CA is reachable from the public internet, you do not need a Jamf SCEP proxy.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS and iOS with Jamf Pro (SCEP) macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. A SCEP Challenge webhook is added to the Jamf tenant configuration. vendor_documented Evidence status: supported Add a SCEP Challenge webhook to your Jamf tenant configuration.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Configure a SCEP challenge webhook macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The Jamf webhook event is SCEPChallenge. vendor_documented Evidence status: supported Select SCEPChallenge as the webhook eventSmallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Configure a SCEP challenge webhook macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The SCEP enrollment webhook lets Jamf request a dynamic, short-lived challenge string from Smallstep during the SCEP request. vendor_documented Evidence status: supported The SCEP Enrollment webhook allows Jamf to request a dynamic, short-lived challenge string from Smallstep during the SCEP request. The challenge string is injected into the SCEP payload for your clients to authenticate to Smallstep.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure a SCEP enrollment webhook in Jamf Pro macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The device should already be enrolled with a basic Jamf MDM profile. vendor_documented Evidence status: supported For the device to appear, the device should already be enrolled with a basic Jamf MDM profile.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Upload and test the configuration profile macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The Jamf SCEP setup guide is for Device or Computer Level MDM profiles, not User Level profiles. vendor_documented Evidence status: supported This tutorial is for Device or Computer Level MDM profiles, not User Level profiles.Smallstep documentation: Deploy EAP-TLS Wi-Fi certificates to Apple devices with Smallstep and Jamf Pro; Introduction macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The page contrasts the SCEP path with ACME-DA, where the private key is hardware-bound, and does not state key protection for the SCEP path. inferred Evidence status: supported On macOS, you can replace SCEP with ACME Device Attestation (ACME-DA) for a higher-assurance workflow: the private key is hardware-bound,Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
macOS · ACME device-attestation payloadWi-Fi EAP-TLS · native MDM enrollment	Smallstep	Jamf Pro	Secure Enclave	device attestation	supportedVerified 2026-10-29
Requirements, limitations and evidence 20 cited claims Workflow reference: `wf-smallstep-jamf-macos-wifi-acme-da` On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME device-attestation payload through native MDM enrollment and issued by Smallstep: key protection Secure Enclave, attestation evidence device attestation verified by CA, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose Wi-Fi EAP-TLS Enrollment method ACME device-attestation payload Enrollment service native MDM enrollment Issuer type third-party CA Key protection Secure Enclave Attestation evidence device attestation Verification type vendor documented Prerequisites Jamf Pro connected to Smallstep with inventory sync; the Mac already synced into the Smallstep inventory, with a user assigned and approved; Computer Level configuration profile installed automatically; ACME Certificate payload with the device authority ACME-DA directory URL, Client identifier $SERIALNUMBER, Key Type ECSECPrimeRandom, Key Size 384, Hardware Bound True, Attest True; Core Concepts states ACME DA is only available to managed devices in Supervised mode. Apple: attestation is issued to Macs with Apple silicon; T2 Macs yield no attestation (Attest ignored); hardware-bound keys are EC 256 or 384. Notes and documented limits Documented in the Smallstep wireless networks tutorial, not on the Connect Jamf Pro page. The page says the key is hardware-bound and does not name the Secure Enclave; secure_enclave is inferred from Core Concepts. Renewal is not described on the page. The issued certificate does not appear in Keychain; the page points to mdmclient QueryCertificates. Evidence for wf-smallstep-jamf-macos-wifi-acme-da (20 claims) After installation the certificate Subject Common Name contains the serial number and the Hardware Bound property reads Yes. vendor_documented Evidence status: supported The Subject Common Name will contain the device serial number, and the Hardware Bound property should say Yes.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Core Concepts states Smallstep can be used on Apple platforms without the agent, with no bootstrapping, when the device is in inventory and marked trusted. vendor_documented Evidence status: supported On Apple platforms, Smallstep can be used without our agent software, with some limitations. For this workflow, there is no bootstrapping required. The device needs to be in the Smallstep inventory and marked as trusted before enrolling.Smallstep documentation: Platform Core Security Concepts Explained; Agentless MDM enrollment macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Core Concepts describes device attested keys as proving a specific key is on a specific device, including proof of the serial number or other hardware identifier. vendor_documented Evidence status: supported This allows a third party to prove that a specific key is stored on a specific device or secure element. The device attestation includes cryptographic proof of the device’s serial number or other unique hardware identifier.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The Connect Jamf Pro page documents inventory sync from Jamf to Smallstep with a partial sync every hour and a full sync every 8 hours. vendor_documented Evidence status: supported Smallstep will do a partial sync of your device inventory from Jamf every hour, and a full sync every 8 hours.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure a SCEP enrollment webhook in Jamf Pro macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The device must have a user assigned and must be approved before it can obtain a certificate through ACME-DA. vendor_documented Evidence status: supported The device must have a user assigned, and it must be approved.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Smallstep documents replacing SCEP with ACME Device Attestation on macOS with Jamf, with a hardware-bound private key and Apple attestation of the request origin. vendor_documented Evidence status: supported On macOS, you can replace SCEP with ACME Device Attestation (ACME-DA) for a higher-assurance workflow: the private key is hardware-bound, and Apple's attestation authority cryptographically proves the certificate request came from a specific, genuine Apple device.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. In this path Jamf manages all settings and the Smallstep Agent is not involved. vendor_documented Evidence status: supported Jamf manages all settings; the Smallstep Agent is not involved.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The device must already be synced from Jamf into the Smallstep inventory because ACME-DA requests are checked against the serial number. vendor_documented Evidence status: supported The device must already be synced from Jamf into your Smallstep inventory, because ACME-DA requests are checked against known device identifiers (the serial number, on macOS).Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The ACME Certificate payload uses $SERIALNUMBER as Client identifier, Key Size 384, Key Type ECSECPrimeRandom, Hardware Bound True and Attest True. vendor_documented Evidence status: supported Set $SERIALNUMBER as the “Client identifier” Set 384 as the “Key Size” Select “ECSECPrimeRandom” as the “Key Type” Set “Hardware Bound” to “True” Set “Subject” to CN=$SERIALNUMBER Set “Extended Key Usage” to 1.3.6.1.5.5.7.3.2 Set “Attest” to “True”Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The ACME directory URL field takes the device authority ACME-DA provisioner URL. vendor_documented Evidence status: supported Put the full URL of your device authority's ACME-DA provisioner in the “ACME directory URL” field. It will look like https://devices.[your team].ca.smallstep.com/acme/acme-da/directory.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The profile is a Computer Level profile with Install automatically as the distribution method. vendor_documented Evidence status: supported In the general settings, make it a “Computer Level” profile, and ensure “Install automatically” is chosen as the “Distribution Method”.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The Network payload selects the ACME Certificate as the identity certificate with TLS as the accepted EAP type. vendor_documented Evidence status: supported Check “TLS” under “Accepted EAP Types” Pick the ACME Certificate you created earlier as the “Identity Certificate”Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The issued certificate does not appear in the Keychain application and is inspected with mdmclient QueryCertificates. vendor_documented Evidence status: supported Due to how managed device attestation works on macOS, the issued certificate won't appear in the Keychain application; you can inspect it with sudo /usr/libexec/mdmclient QueryCertificates instead.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Core Concepts states that Apple limits hardware attestations to the Managed Device Attestation workflow using ACME DA, available only to managed devices in Supervised mode. vendor_documented Evidence status: supported For this reason, Apple limits hardware attestations to the Managed Device Attestation (MDA) workflow, using ACME DA, which is only available to managed devices in Supervised mode.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the macOS (agentless) column. vendor_documented Evidence status: supported Wi-Fi \| Smallstep attested \| device attested \| device attested \| device attested \| device attestedSmallstep documentation: Platform Core Security Concepts Explained; A note about provisioned credentials macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The columns of that table are macOS (Smallstep agent), macOS (agentless), Windows, Linux and ChromeOS. vendor_documented Evidence status: supported macOS (Smallstep agent) \| macOS (agentless) \| Windows \| Linux \| ChromeOSSmallstep documentation: Platform Core Security Concepts Explained; A note about provisioned credentials macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that Attest set to TRUE requires HardwareBound set to TRUE. vendor_documented Evidence status: supported When Attest is set to TRUE, HardwareBound also needs to be set to TRUE.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table) macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that with HardwareBound the Secure Enclave generates the key pair and the private key is entangled with a system key. vendor_documented Evidence status: supported The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Hardware bound (settings table) macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple's developer hardware support table lists the Attest key as Ignored for T2 Macs, so a T2 Mac yields no attestation to the ACME server. vendor_documented Evidence status: supported \|Ignored \|A10x Fusion and earlier \|T2 \|A10x Fusion and earlier\|S3 and earlier\|none \|Apple Developer Documentation: ACMECertificate \| Apple Developer Documentation (Device Management); ACME attestation hardware support macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that attestations are issued to Mac computers with Apple silicon. vendor_documented Evidence status: supported Mac computers: With Apple silicon.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Supported hardware for Managed Device Attestation macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
iOS · SCEP profileWi-Fi EAP-TLS · SCEP gateway	Smallstep	Jamf Pro	not documented by the vendor	not documented by the vendor	supportedVerified 2026-10-29
Requirements, limitations and evidence 4 cited claims Workflow reference: `wf-smallstep-jamf-ios-wifi-scep` On iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29). Operating system iOS Certificate purpose Wi-Fi EAP-TLS Enrollment method SCEP profile Enrollment service SCEP gateway Issuer type third-party CA Key protection not documented by the vendor Attestation evidence not documented by the vendor Verification type vendor documented Prerequisites Jamf Pro connected to Smallstep; SCEP Challenge webhook with the SCEPChallenge event; device enrolled with a basic Jamf MDM profile; Device Level profile, not User Level. Notes and documented limits iOS is named only in the section heading macOS and iOS with Jamf Pro (SCEP); the body text does not single out iOS steps. The Smallstep Jamf pages do not document an ACME-DA path for iOS. Key protection, attestation and renewal are not stated for this path. Evidence for wf-smallstep-jamf-ios-wifi-scep (4 claims) The Jamf SCEP section heading names macOS and iOS, and the workflow obtains a client certificate from the Smallstep SCEP server with dynamic single-use challenges. vendor_documented Evidence status: supported In this workflow, Jamf deploys a configuration profile that establishes CA trust, gets a client certificate via Smallstep's SCEP server (using dynamic, single-use challenges), and configures the Wi-Fi network.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS and iOS with Jamf Pro (SCEP) iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The Smallstep Agent is not required on the device. vendor_documented Evidence status: supported The Smallstep Agent is not required on the device.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS and iOS with Jamf Pro (SCEP) iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The Jamf SCEP setup guide is for Device or Computer Level MDM profiles, not User Level profiles. vendor_documented Evidence status: supported This tutorial is for Device or Computer Level MDM profiles, not User Level profiles.Smallstep documentation: Deploy EAP-TLS Wi-Fi certificates to Apple devices with Smallstep and Jamf Pro; Introduction iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The page contrasts SCEP with the macOS ACME-DA path, where the private key is hardware-bound, and does not state key protection for the iOS SCEP path. inferred Evidence status: supported On macOS, you can replace SCEP with ACME Device Attestation (ACME-DA) for a higher-assurance workflow: the private key is hardware-bound,Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation) iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
macOS · agent enrollmentWi-Fi EAP-TLS · agent	Smallstep	Jamf Pro	Secure Enclave	depends on a documented setting	supportedVerified 2026-10-29
Requirements, limitations and evidence 14 cited claims Workflow reference: `wf-smallstep-jamf-macos-wifi-agent` On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection Secure Enclave, attestation evidence depends on a documented setting verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose Wi-Fi EAP-TLS Enrollment method agent enrollment Enrollment service agent Issuer type third-party CA Key protection Secure Enclave Attestation evidence depends on a documented setting Verification type vendor documented Prerequisites macOS 13 (Ventura) or later; Apple Silicon M1 or later; agent installed for a single user; Smallstep team with Pro features; Jamf Pro tenant with a package distribution point; SCEP enrollment webhook; agent enrollment profile downloaded from Smallstep (SCEP payload, CA certificates, agent settings, Login Items); agent reaches smallstep.com, api.smallstep.com, gateway.smallstep.com, control.infra.smallstep.com, *.[team-name].ca.smallstep.com, auth.smallstep.com, att.smallstep.com, tel.smallstep.com; Location permission for Wi-Fi management. Notes and documented limits Core Concepts labels the macOS agent Wi-Fi tier Smallstep attested: the agent emulates key attestation, the key is generated in the Secure Enclave, and the attestation certificate cannot prove the key is in a genuine Secure Enclave. That tier does not map onto the enum, so attestation_evidence is depends. Key protection fallback is optional per Core Concepts. Evidence for wf-smallstep-jamf-macos-wifi-agent (14 claims) The agent requires macOS 13 or later, Apple Silicon M1 or later, and single-user installation. vendor_documented Evidence status: supported macOS 13 (Ventura) or later Apple Silicon M1 or later The agent must be installed for a single userSmallstep documentation: Install the Smallstep Agent on macOS, Windows, and Linux; macOS macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Core Concepts states that on Apple platforms the agent emulates TPM remote key attestation and that this is not device attestation. vendor_documented Evidence status: supported To support some applications on Apple platforms, our agent can emulate TPM remote key attestation. We use a process similar to the Trusted Computing Group’s remote attestation process. This is not device attestation, however.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The Jamf integration deploys a Smallstep-generated configuration profile that enrolls devices using the Smallstep Agent. vendor_documented Evidence status: supported In this step, we’ll tie everything together by deploying a configuration profile that enrolls devices using the Smallstep Agent. Smallstep generates this profile for your Jamf connection, so you can download it from the Smallstep dashboard and upload it directly to Jamf Pro.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure an agent enrollment profile macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The downloaded profile bundles the SCEP payload, root and intermediate CA certificates, agent settings and the Login Items entry. vendor_documented Evidence status: supported The downloaded profile bundles everything required to enroll a device: the SCEP payload, your root and intermediate CA certificates, the Smallstep agent settings, and the Login Items entry for the agent.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure an agent enrollment profile macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The Jamf integration requires a Smallstep team with Pro features, a Jamf Pro tenant and a package distribution point. vendor_documented Evidence status: supported A Smallstep team with Pro features enabled A Jamf Pro tenant A package distribution point configured in Jamf ProSmallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Requirements & limitations macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The agent can be installed via Jamf package distribution and policy or separately with another tool or scripts. vendor_documented Evidence status: supported There's two ways to install the agent: via Jamf (below): Use Jamf Pro's package distribution and policy management separately: Use a separate software management tool like Munki, or install the agent manually via scripts.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Install the Smallstep agent macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Location permission is required when the agent manages Wi-Fi network configurations on macOS. vendor_documented Evidence status: supported only required if the agent will manage Wi-Fi network configurations.Smallstep documentation: Install the Smallstep Agent on macOS, Windows, and Linux; macOS macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The agent requests the client certificate with the private key generated in the device secure hardware. vendor_documented Evidence status: supported Request a client certificate, generating the private key in the device's secure hardware.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The agent renews the certificate automatically before it expires and creates the EAP-TLS Wi-Fi profile. vendor_documented Evidence status: supported Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. In the Core Concepts key attestation level table, the Wi-Fi row reads Smallstep attested for the macOS (Smallstep agent) column. vendor_documented Evidence status: supported Wi-Fi \| Smallstep attested \| device attested \| device attested \| device attested \| device attestedSmallstep documentation: Platform Core Security Concepts Explained; A note about provisioned credentials macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. In the Smallstep attested workflow the private key is generated in the Secure Enclave and the public key is sent to the Smallstep attestation authority. vendor_documented Evidence status: supported The Smallstep agent creates a key pair. The private key is generated in the Secure Enclave, and the public key is sent to the Smallstep attestation authority.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The Smallstep attestation certificate attests possession of the private key but cannot prove the key is in a genuine Apple Secure Enclave. vendor_documented Evidence status: supported This certificate attests that the client is in possession of the private key, but it cannot prove that the key is stored in a genuine Apple Secure Enclave.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Core Concepts describes an optional hardware protection with fallback approach that uses the highest key protection level available. vendor_documented Evidence status: supported With this option, our software will use the highest key protection level available for a given environment.Smallstep documentation: Platform Core Security Concepts Explained; A note about fallbacks macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The HARDWARE_ATTESTED credential setting generates the key in the TPM or Secure Enclave and requires remote attestation. vendor_documented Evidence status: supported HARDWARE_ATTESTED generates the key in the device's secure hardware (TPM or Secure Enclave) and requires remote attestation.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Create the credential macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
macOS · SCEP profileWi-Fi EAP-TLS · native MDM enrollment	Active Directory Certificate Services	Jamf Pro	not documented by the vendor	none (documented absence)	supportedVerified 2026-10-29
Requirements, limitations and evidence 13 cited claims Workflow reference: `wf-jamf-pro-macos-wifi-scep-proxy-adcs` On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose Wi-Fi EAP-TLS Enrollment method SCEP profile Enrollment service native MDM enrollment Issuer type AD CS Key protection not documented by the vendor Attestation evidence none (documented absence) Verification type vendor documented Prerequisites Enable Jamf Pro as SCEP Proxy for configuration profiles in Settings > PKI certificates > Management Certificate Template > External CA; SCEP server base URL; challenge type Static, Dynamic (Jamf Pro 10.32.0 or later, SCEPChallenge webhook), Dynamic-Microsoft CA, or Dynamic-Entrust; upload a signing certificate keystore (.jks or .p12) with the signing and CA certificates. When Jamf Pro is the proxy, only one NDES server can be specified. Notes and documented limits Jamf Pro communicates with the SCEP server on behalf of the device and installs the certificate. Jamf's AD CS technical paper lists SCEP through Microsoft NDES as a method that can use the Jamf Pro SCEP proxy feature. The Redistribute Profile option re-issues the profile a set number of days before expiry. Key protection is not documented by Jamf or Apple for SCEP-issued identities. Evidence for wf-jamf-pro-macos-wifi-scep-proxy-adcs (13 claims) Jamf documents that only one NDES server can be specified when Jamf Pro is used as the SCEP proxy. vendor_documented Evidence status: supported When using Jamf Pro as proxy, only one NDES server can be specified.Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Overview (feature comparison table footnote) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that configuration profile certificate payloads provide user access to resources such as VPN or Wi-Fi, which names the relying parties for these certificates. vendor_documented Evidence status: supported Jamf Pro allows you to create configuration profiles with payloads that contain certificates for user access to resources such as VPN or Wi-Fi.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that with Jamf Pro enabled as SCEP proxy, Jamf Pro communicates with the SCEP server and installs the certificate on computers or mobile devices. vendor_documented Evidence status: supported Enabling Jamf Pro as SCEP Proxy for a configuration profile allows Jamf Pro to communicate with your SCEP server to install the certificate directly on computers or mobile devices.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that Jamf Pro as SCEP proxy must be enabled in the PKI Certificate settings before a configuration profile can be distributed with it. vendor_documented Evidence status: supported Before you can distribute a configuration profile with Jamf Pro as SCEP Proxy for the certificates included in the profile, you must enable Jamf Pro as SCEP Proxy in the PKI Certificate settings.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf names a Microsoft certificate authority SCEP instance (SERVERNAME-MSCEP-RA) as the example for the SCEP proxy instance name. vendor_documented Evidence status: supported For Microsoft certificate authorities, SERVERNAME-MSCEP-RA is an example.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Note macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that the SCEP challenge password is used as the pre-shared secret for automatic enrollment when the Static challenge type is chosen. vendor_documented Evidence status: supported The challenge password will be used as the pre-shared secret for automatic enrollment.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles (Challenge Type step) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; Static challenge type Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that an external CA used with the SCEP proxy requires the signing and CA certificates to be provided to Jamf Pro after saving. vendor_documented Evidence status: supported If you are using an external CA, you need to provide the signing and CA certificates for the external CA after saving.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles (closing paragraph) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf lists SCEP through Microsoft Network Device Enrollment Service (NDES) as an AD CS integration method, and the same list item states that it can use the Jamf Pro SCEP proxy feature. vendor_documented Evidence status: supported Simple Certificate Enrollment Protocol (SCEP) using Microsoft Network Device Enrollment Service (NDES)Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Overview (integration methods list) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents a Redistribute Profile option on the SCEP payload that redistributes the configuration profile a chosen number of days before the certificate expires, which places renewal with Jamf Pro. vendor_documented Evidence status: supported (Optional) If you want the configuration profile to be redistributed to devices before the certificate expires, select the number of days before the expiration date that you want from the Redistribute Profile pop-up menu.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (step 9) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; documented on the AD CS SCEP payload page Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from a SCEP payload, among other payloads. vendor_documented Evidence status: supported This can be an Active Directory Certificate payload (macOS only), an ACME payload, a PKCS #12 identity certificate (.p12 or .pfx) file in the Certificates payload or an SCEP payload.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents the RADIUS server as the counterpart in the 802.1X negotiation with the device supplicant. vendor_documented Evidence status: supported During the 802.1X negotiation, the RADIUS server presents its certificate to the device supplicant automatically.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); Connect Apple devices to 802.1X networks (introduction) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation. vendor_documented Evidence status: supported Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents the SCEP payload as the setting that lets the device obtain certificates from a certificate authority using SCEP. vendor_documented Evidence status: supported Use the SCEP payload to specify settings that allow the device to obtain certificates from a certificate authority (CA) using the Simple Certificate Enrollment Protocol (SCEP).Apple Platform Deployment: SCEP device management payload settings for Apple devices - Apple Support; SCEP device management payload settings for Apple devices (intro) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
iOS · SCEP profileWi-Fi EAP-TLS · native MDM enrollment	Active Directory Certificate Services	Jamf Pro	not documented by the vendor	none (documented absence)	supportedVerified 2026-10-29
Requirements, limitations and evidence 8 cited claims Workflow reference: `wf-jamf-pro-ios-wifi-scep-proxy-adcs` On iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by Active Directory Certificate Services: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29). Operating system iOS Certificate purpose Wi-Fi EAP-TLS Enrollment method SCEP profile Enrollment service native MDM enrollment Issuer type AD CS Key protection not documented by the vendor Attestation evidence none (documented absence) Verification type vendor documented Prerequisites Same Jamf Pro SCEP proxy configuration as the macOS record: SCEP proxy enabled in PKI Certificates, SCEP server base URL, challenge type, signing certificate keystore. Jamf's text covers computers and mobile devices together. Notes and documented limits Jamf's SCEP proxy technical paper addresses computers and mobile devices in the same sentences. Apple's 802.1X page states that iOS, iPadOS and macOS supplicants send the certificate identity common name to the RADIUS server. Key protection is not documented by Jamf or Apple for SCEP-issued identities. Evidence for wf-jamf-pro-ios-wifi-scep-proxy-adcs (8 claims) Jamf documents that configuration profile certificate payloads provide user access to resources such as VPN or Wi-Fi. vendor_documented Evidence status: supported Jamf Pro allows you to create configuration profiles with payloads that contain certificates for user access to resources such as VPN or Wi-Fi.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that with Jamf Pro enabled as SCEP proxy, Jamf Pro communicates with the SCEP server and installs the certificate on computers or mobile devices. vendor_documented Evidence status: supported Enabling Jamf Pro as SCEP Proxy for a configuration profile allows Jamf Pro to communicate with your SCEP server to install the certificate directly on computers or mobile devices.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf lists SCEP through Microsoft Network Device Enrollment Service (NDES) as an AD CS integration method for computers and mobile devices, and the same list item states that it can use the Jamf Pro SCEP proxy feature. vendor_documented Evidence status: supported Simple Certificate Enrollment Protocol (SCEP) using Microsoft Network Device Enrollment Service (NDES)Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Overview (integration methods list) iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents a Redistribute Profile option on the SCEP payload that redistributes the configuration profile a chosen number of days before the certificate expires. vendor_documented Evidence status: supported (Optional) If you want the configuration profile to be redistributed to devices before the certificate expires, select the number of days before the expiration date that you want from the Redistribute Profile pop-up menu.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (step 9) iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; documented on the AD CS SCEP payload page Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from a SCEP payload, among other payloads. vendor_documented Evidence status: supported This can be an Active Directory Certificate payload (macOS only), an ACME payload, a PKCS #12 identity certificate (.p12 or .pfx) file in the Certificates payload or an SCEP payload.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that iOS, iPadOS and macOS supplicants send the certificate identity common name to the RADIUS server during 802.1X negotiation, which names the RADIUS server as the relying party. vendor_documented Evidence status: supported By default, iOS, iPadOS, and macOS supplicants use the certificate identity common name for the EAP Response Identity it sends to the RADIUS server during 802.1X negotiation.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation. vendor_documented Evidence status: supported Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro) iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple lists iOS and iPadOS among the supported operating systems and channels for the SCEP payload. vendor_documented Evidence status: supported Supported operating systems and channels: iOS, iPadOS, Shared iPad device, macOS device, macOS user, tvOS, watchOS 10, visionOS 1.1.Apple Platform Deployment: SCEP device management payload settings for Apple devices - Apple Support; SCEP device management payload settings for Apple devices (intro) iOS and iPadOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
macOS · SCEP profileWi-Fi EAP-TLS · native MDM enrollment	platform CA	Jamf Pro	not documented by the vendor	none (documented absence)	supportedVerified 2026-10-29
Requirements, limitations and evidence 4 cited claims Workflow reference: `wf-jamf-pro-macos-wifi-scep-proxy-builtin-ca` On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose Wi-Fi EAP-TLS Enrollment method SCEP profile Enrollment service native MDM enrollment Issuer type platform CA Key protection not documented by the vendor Attestation evidence none (documented absence) Verification type vendor documented Prerequisites Enable Jamf Pro as SCEP Proxy for configuration profiles in PKI Certificates. When the Jamf Pro built-in CA is used, no signing certificate upload is needed after saving. Notes and documented limits Jamf's SCEP proxy technical paper states that no further action is needed after saving when the Jamf Pro built-in CA is used, within the procedure for enabling SCEP proxy for configuration profiles. Jamf's page gives no further detail specific to built-in CA issuance for Wi-Fi. Key protection is not documented by Jamf or Apple for SCEP-issued identities. Renewal for this combination is not documented on the pages retrieved. Evidence for wf-jamf-pro-macos-wifi-scep-proxy-builtin-ca (4 claims) Jamf documents, within the procedure for enabling Jamf Pro as SCEP proxy for configuration profiles, that no further action is needed after saving when the Jamf Pro built-in CA is used. vendor_documented Evidence status: supported If you are using the Jamf Pro built-in CA, no action is necessary after saving.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles (closing paragraph) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that configuration profile certificate payloads provide user access to resources such as VPN or Wi-Fi. vendor_documented Evidence status: supported Jamf Pro allows you to create configuration profiles with payloads that contain certificates for user access to resources such as VPN or Wi-Fi.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that the CA hosted by Jamf Pro, the built-in CA, supports SCEP. vendor_documented Evidence status: supported The CA hosted by Jamf Pro (the “built-in CA”) supports SCEP.Jamf: Jamf Pro Administrator's Guide Version 10.28.0; Security > Simple Certificate Enrollment Protocol macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Jamf Pro built-in CA; statement taken from the Jamf Pro 10.28.0 administrator's guide Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation. vendor_documented Evidence status: supported Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro) macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
macOS · ACME payloadWi-Fi EAP-TLS · ACME service	third-party CA	Jamf Pro	depends on a documented setting	none (documented absence)	supportedVerified 2026-10-29
Requirements, limitations and evidence 11 cited claims Workflow reference: `wf-jamf-pro-macos-wifi-acme-third-party` On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME payload through ACME service and issued by third-party CA: key protection depends on a documented setting, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose Wi-Fi EAP-TLS Enrollment method ACME payload Enrollment service ACME service Issuer type third-party CA Key protection depends on a documented setting Attestation evidence none (documented absence) Verification type vendor documented Prerequisites Jamf Pro 11.7 or later (ACME Certificate payload added July 2024). Apple ACME payload availability macOS 13.1 or later. An ACME server reachable by the device; Apple's device flow expects the device-attest-01 challenge type. Hardware binding of the key is optional in this record (HardwareBound false or true with Attest false). Automatic redistribution before expiry requires Jamf Pro 11.19 or later and a CA template that accepts an OU value. Notes and documented limits Jamf's release note names the ACME Certificate payload for computers and mobile devices without naming a CA. Apple's payload documentation defines the key, attestation and hardware-binding settings. With Attest false or ignored, the ACME server receives no attestation. Jamf Pro 11.19 added automatic redistribution of ACME certificates a set number of days before expiry. Evidence for wf-jamf-pro-macos-wifi-acme-third-party (11 claims) Apple's developer reference states that the ACME server responds to the device's order with a device-attest-01 challenge, which the ACME CA must therefore support. vendor_documented Evidence status: supported The ACME server responds with a challenge type of `device-attest-01`.Apple Developer Documentation: ACMECertificate \| Apple Developer Documentation (Device Management); Discussion macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple's developer reference states that the ACME server receives no attestation when the Attest key is false or ignored. vendor_documented Evidence status: supported If the Attest key is false or ignored, the ACME server does not receive an attestation.Apple Developer Documentation: ACMECertificate \| Apple Developer Documentation (Device Management); ACME attestation hardware support macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest false; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro. vendor_documented Evidence status: supported The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents the ACME Certificate payload as the way to obtain certificates from a CA for Apple devices enrolled in a device management service. vendor_documented Evidence status: supported You can configure the ACME Certificate payload to obtain certificates from a certificate authority (CA) for users of Apple devices that enroll in a device management service.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro) macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple's developer reference lists the ACMECertificate payload as available from macOS 13.1. vendor_documented Evidence status: supported macOS: 13.1.0 -Apple Developer Documentation: ACMECertificate \| Apple Developer Documentation (Device Management); availability (page metadata) macOS 13.1 or later; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that with ACME the private key stays on the device and can optionally be hardware bound, so key protection depends on the HardwareBound setting. vendor_documented Evidence status: supported With this technique, the private key remains only on the device, and can optionally be hardware bound to the device.Apple Platform Deployment: Distribute certificates to Apple devices - Apple Support; Certificate deployment methods that use device management configurations macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf's release announcement for Jamf Pro 11.19 (July 31, 2025) states that Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before expiry, which places renewal with Jamf Pro. vendor_documented Evidence status: supported You can configure Jamf Pro to automatically redistribute ACME certificates to computers and mobile devices at a specified number of days before the certificates expire.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf states that automatic redistribution of ACME certificates requires the ACME certificate authority template to accept an OU value, because Jamf Pro inserts a profile identifier as an organizational unit. vendor_documented Evidence status: supported Your ACME certificate authority template must also support the inclusion of an OU value to use this functionality.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates (Note) macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that certificates deployed through a device management service need to be renewed by that service before they expire, and documents automatic renewal only for Active Directory certificates on macOS 13 or later. vendor_documented Evidence status: supported To ensure ongoing service access, you need to renew any certificates you deploy using a device management service before they expire.Apple Platform Deployment: Distribute certificates to Apple devices - Apple Support; Renew certificates installed by configuration profiles macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from an ACME payload, among other payloads. vendor_documented Evidence status: supported This can be an Active Directory Certificate payload (macOS only), an ACME payload, a PKCS #12 identity certificate (.p12 or .pfx) file in the Certificates payload or an SCEP payload.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents 802.1X EAP-TLS authentication as a use of a certificate identity on Apple devices. vendor_documented Evidence status: supported An identity can be used for authentication (such as 802.1X EAP-TLS), signing or encryption (such as S/MIME).Apple Platform Deployment: Intro to certificate management for Apple devices - Apple Support (UK); Supported identity types macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
iOS · ACME payloadWi-Fi EAP-TLS · ACME service	third-party CA	Jamf Pro	depends on a documented setting	none (documented absence)	supportedVerified 2026-10-29
Requirements, limitations and evidence 7 cited claims Workflow reference: `wf-jamf-pro-ios-wifi-acme-third-party` On iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME payload through ACME service and issued by third-party CA: key protection depends on a documented setting, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29). Operating system iOS Certificate purpose Wi-Fi EAP-TLS Enrollment method ACME payload Enrollment service ACME service Issuer type third-party CA Key protection depends on a documented setting Attestation evidence none (documented absence) Verification type vendor documented Prerequisites Jamf Pro 11.7 or later (ACME Certificate payload for computers and mobile devices). Apple ACME payload availability iOS 16.0 or later and iPadOS 16.0 or later. An ACME server that issues the device-attest-01 challenge type. Automatic redistribution before expiry requires Jamf Pro 11.19 or later. Notes and documented limits Jamf's release note covers mobile devices together with computers. Apple lists iOS and iPadOS among the supported operating systems and channels for the ACME payload. With Attest false or ignored, the ACME server receives no attestation. Evidence for wf-jamf-pro-ios-wifi-acme-third-party (7 claims) Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro. vendor_documented Evidence status: supported The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple lists iOS and iPadOS among the supported operating systems and channels for the ACME payload. vendor_documented Evidence status: supported Supported operating systems and channels: iOS, iPadOS, Shared iPad device, macOS device, macOS user, tvOS, watchOS 10, visionOS 1.1.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro) iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple's developer reference lists the ACMECertificate payload as available from iOS 16.0. vendor_documented Evidence status: supported iOS: 16.0.0 -Apple Developer Documentation: ACMECertificate \| Apple Developer Documentation (Device Management); availability (page metadata) iOS 16.0 or later and iPadOS 16.0 or later; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that with ACME the private key stays on the device and can optionally be hardware bound, so key protection depends on the HardwareBound setting. vendor_documented Evidence status: supported With this technique, the private key remains only on the device, and can optionally be hardware bound to the device.Apple Platform Deployment: Distribute certificates to Apple devices - Apple Support; Certificate deployment methods that use device management configurations iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple's developer reference states that the ACME server receives no attestation when the Attest key is false or ignored. vendor_documented Evidence status: supported If the Attest key is false or ignored, the ACME server does not receive an attestation.Apple Developer Documentation: ACMECertificate \| Apple Developer Documentation (Device Management); ACME attestation hardware support iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest false; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf's release announcement for Jamf Pro 11.19 (July 31, 2025) states that Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before expiry. vendor_documented Evidence status: supported You can configure Jamf Pro to automatically redistribute ACME certificates to computers and mobile devices at a specified number of days before the certificates expire.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that iOS, iPadOS and macOS supplicants send the certificate identity common name to the RADIUS server during 802.1X negotiation, which names the RADIUS server as the relying party. vendor_documented Evidence status: supported By default, iOS, iPadOS, and macOS supplicants use the certificate identity common name for the EAP Response Identity it sends to the RADIUS server during 802.1X negotiation.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
macOS · ACME device-attestation payloadWi-Fi EAP-TLS · ACME service	third-party CA	Jamf Pro	Secure Enclave	device attestation	supportedVerified 2026-10-29
Requirements, limitations and evidence 23 cited claims Workflow reference: `wf-jamf-pro-macos-wifi-acme-da-third-party` On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME device-attestation payload through ACME service and issued by third-party CA: key protection Secure Enclave, attestation evidence device attestation verified by CA, renewal by MDM, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose Wi-Fi EAP-TLS Enrollment method ACME device-attestation payload Enrollment service ACME service Issuer type third-party CA Key protection Secure Enclave Attestation evidence device attestation Verification type vendor documented Prerequisites macOS 14 or later for Managed Device Attestation (Apple). Mac with Apple silicon: Apple's developer table lists the Attest key as Ignored on T2 Macs and as Must be false on T1 and earlier Macs. Attest TRUE requires HardwareBound TRUE; hardware-bound keys require KeyType ECSECPrimeRandom with KeySize 256 or 384; RSA keys require HardwareBound FALSE. Jamf Pro 11.7 or later for the ACME Certificate payload. An ACME CA that handles the device-attest-01 challenge and validates the attestation chain to the Apple Enterprise Attestation Root CA. Hardware-bound keys are removed when the device is erased or restored and the profile must be applied again. Notes and documented limits Apple documents the Attest and HardwareBound settings, Secure Enclave key generation, and the ACME service as the party that receives and validates the attestation. Jamf's release note documents the ACME Certificate payload; the Attest control in the Jamf Pro interface is evidenced by a Jamf blog post rather than by retrievable learn.jamf.com body text (see notes.md). Jamf Pro 11.19 added automatic redistribution of ACME certificates. Evidence for wf-jamf-pro-macos-wifi-acme-da-third-party (23 claims) Apple's developer reference states that when Attest is true the device requests an attestation of the key and device properties. vendor_documented Evidence status: supported If `Attest` is `true` the device requests an attestation of the key and device properties.Apple Developer Documentation: ACMECertificate \| Apple Developer Documentation (Device Management); Discussion macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that Attest set to TRUE requires HardwareBound set to TRUE. vendor_documented Evidence status: supported When Attest is set to TRUE, HardwareBound also needs to be set to TRUE.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table) macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro. vendor_documented Evidence status: supported The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. A Jamf blog post (October 27 2022) states that the ACME payload profile can be installed through an MDM such as Jamf Pro; this is a vendor blog, not product documentation. vendor_documented Evidence status: supported Apple Admins can install a newly-supported Automatic Certificate Management Environment (ACME) payload profile through an MDM, such as Jamf Pro.Jamf Blog: Apple Managed Device Attestation and Jamf; How does MDA work? macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. A Jamf blog post (October 27 2022) states that with a profile containing an ACME payload the device provides an attestation to the organization's ACME server; this is a vendor blog, not product documentation. vendor_documented Evidence status: supported With a profile containing an ACME payload, your device provides an attestation to an organization's ACME server.Jamf Blog: Apple Managed Device Attestation and Jamf; How does MDA work? macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that when Attest is true the device provides attestations describing the device and the generated key to the ACME server. vendor_documented Evidence status: supported If true, the device provides attestations describing the device and the generated key to the ACME server.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table) macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that with HardwareBound the Secure Enclave generates the key pair and the private key is entangled with a system key. vendor_documented Evidence status: supported The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Hardware bound (settings table) macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that hardware bound keys support only key sizes 256 and 384 (ECSECPrimeRandom key type). vendor_documented Evidence status: supported Hardware bound keys only support values of 256 and 384.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Key type (settings table) macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that RSA key pairs in the ACME payload require HardwareBound FALSE, so an attested hardware-bound identity uses an EC key. vendor_documented Evidence status: supported RSA key pairs need to have a KeySize in the range [1024…4096] inclusive and a multiple of 8, and HardwareBound needs to be FALSE.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Key type (settings table) macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents Managed Device Attestation as a feature of iOS 16, iPadOS 16.1, macOS 14, tvOS 16, or later. vendor_documented Evidence status: supported Managed Device Attestation is a feature for devices with iOS 16, iPadOS 16.1, macOS 14, tvOS 16, or later.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation for Apple devices (introduction) macOS 14 or later; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that attestations are issued to Mac computers with Apple silicon. vendor_documented Evidence status: supported Mac computers: With Apple silicon.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Supported hardware for Managed Device Attestation macOS on Mac computers with Apple silicon; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple's developer hardware support table lists the Attest key as Ignored for T2 Macs, so a T2 Mac yields no attestation to the ACME server. vendor_documented Evidence status: supported \|Ignored \|A10x Fusion and earlier \|T2 \|A10x Fusion and earlier\|S3 and earlier\|none \|Apple Developer Documentation: ACMECertificate \| Apple Developer Documentation (Device Management); ACME attestation hardware support macOS on Intel Mac computers with the T2 chip; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that with attestation the operating system generates a hardware-bound private key inside the Secure Enclave as part of the certificate signing request. vendor_documented Evidence status: supported If you use attestation, the operating system generates a hardware-bound private key inside the device’s Secure Enclave as part of the certificate-signing request.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation with ACME certificate enrollment requests macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that ACME payload attestation lets the enrollment cryptographically validate device genuineness, device identity, management state, device properties and hardware binding of the private key. vendor_documented Evidence status: supported Using ACME payload attestation, a device management service can enroll a client certificate identity using the ACME protocol, which can cryptographically validate that:Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation with ACME certificate enrollment requests macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple's developer guidance states that the ACME service receives the attestation certificate chain in the device-attest-01 challenge response, which makes the ACME CA the attestation verifier. vendor_documented Evidence status: supported Your ACME service receives the attestation certificate chain when the device responds to the `device-attest-01` challenge.Apple Developer Documentation: Validating a Managed Device Attestation \| Apple Developer Documentation (Device Management); Validate an ACME attestation macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple's developer guidance states that the ACME service proceeds to the finalize phase only after its validation steps succeed, which places the validation decision with the ACME CA. vendor_documented Evidence status: supported When all of the validation steps succeed, your ACME service can proceed to the `finalize` phase of the ACME protocol.Apple Developer Documentation: Validating a Managed Device Attestation \| Apple Developer Documentation (Device Management); Validate an ACME attestation macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that hardware-bound keys are removed when a device is erased or restored and that the profile must be applied again to recreate them. vendor_documented Evidence status: supported These hardware-bound keys are automatically removed when erasing or restoring a device. Because the keys are removed, any configuration profiles relying on those keys won’t work after a restore. The profile needs to be applied again to get the keys recreated.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation with ACME certificate enrollment requests macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents the Secure Enclave as isolated from the main processor and designed to keep sensitive data secure even when the Application Processor kernel is compromised. vendor_documented Evidence status: supported The Secure Enclave is isolated from the main processor to provide an extra layer of security and is designed to keep sensitive user data secure even when the Application Processor kernel becomes compromised.Apple Platform Security: The Secure Enclave - Apple Support; Overview macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple lists all Mac computers with Apple silicon among the devices that have a Secure Enclave. vendor_documented Evidence status: supported All Mac computers with Apple siliconApple Platform Security: The Secure Enclave - Apple Support; Overview (device list) macOS on Mac computers with Apple silicon; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple lists Intel-based Mac computers with the Apple T2 Security Chip among devices with a Secure Enclave, while the developer table lists the Attest key as Ignored on T2 Macs. vendor_documented Evidence status: supported All Intel-based Mac computers that contain the Apple T2 Security ChipApple Platform Security: The Secure Enclave - Apple Support; Overview (device list) macOS on Intel Mac computers with the T2 chip; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf's release announcement for Jamf Pro 11.19 (July 31, 2025) states that Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before expiry, which places renewal with Jamf Pro. vendor_documented Evidence status: supported You can configure Jamf Pro to automatically redistribute ACME certificates to computers and mobile devices at a specified number of days before the certificates expire.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that certificates deployed through a device management service need to be renewed by that service before they expire; the operating system is not documented as renewing ACME certificates on its own. vendor_documented Evidence status: supported To ensure ongoing service access, you need to renew any certificates you deploy using a device management service before they expire.Apple Platform Deployment: Distribute certificates to Apple devices - Apple Support; Renew certificates installed by configuration profiles macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from an ACME payload, among other payloads. vendor_documented Evidence status: supported This can be an Active Directory Certificate payload (macOS only), an ACME payload, a PKCS #12 identity certificate (.p12 or .pfx) file in the Certificates payload or an SCEP payload.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
iOS · ACME device-attestation payloadWi-Fi EAP-TLS · ACME service	third-party CA	Jamf Pro	Secure Enclave	device attestation	supportedVerified 2026-10-29
Requirements, limitations and evidence 14 cited claims Workflow reference: `wf-jamf-pro-ios-wifi-acme-da-third-party` On iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME device-attestation payload through ACME service and issued by third-party CA: key protection Secure Enclave, attestation evidence device attestation verified by CA, renewal by MDM, support status supported (vendor documented, verified 2026-10-29). Operating system iOS Certificate purpose Wi-Fi EAP-TLS Enrollment method ACME device-attestation payload Enrollment service ACME service Issuer type third-party CA Key protection Secure Enclave Attestation evidence device attestation Verification type vendor documented Prerequisites iOS 16 or later and iPadOS 16.1 or later for Managed Device Attestation (Apple). iPhone and iPad with the A11 Bionic chip or later, or any M series chip (Apple's developer table lists A10x Fusion and earlier as Ignored). Attest TRUE requires HardwareBound TRUE with KeyType ECSECPrimeRandom and KeySize 256 or 384. Jamf Pro 11.7 or later for the ACME Certificate payload. An ACME CA that handles the device-attest-01 challenge and validates the attestation chain. Notes and documented limits Same evidence pattern as the macOS record. Filed partial only because the Jamf blog post states iPadOS 16 while Apple states iPadOS 16.1 for Managed Device Attestation; the pair is filed as conflicting and the status stays partial until the owner resolves it. Hardware-bound keys are removed when the device is erased or restored. The Jamf blog states iPadOS 16 for Managed Device Attestation; Apple documents iPadOS 16.1 and governs for Apple OS versions. Evidence for wf-jamf-pro-ios-wifi-acme-da-third-party (14 claims) Apple documents that with attestation the operating system generates a hardware-bound private key inside the Secure Enclave as part of the certificate signing request. vendor_documented Evidence status: supported If you use attestation, the operating system generates a hardware-bound private key inside the device’s Secure Enclave as part of the certificate-signing request.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation with ACME certificate enrollment requests iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro. vendor_documented Evidence status: supported The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. A Jamf blog post (October 27 2022) states that with a profile containing an ACME payload the device provides an attestation to the organization's ACME server; this is a vendor blog, not product documentation. vendor_documented Evidence status: supported With a profile containing an ACME payload, your device provides an attestation to an organization's ACME server.Jamf Blog: Apple Managed Device Attestation and Jamf; How does MDA work? iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. A Jamf blog post states that Managed Device Attestation arrived with OS 16 including iOS 16, iPadOS 16 and tvOS 16. A vendor blog is a secondary source for an Apple OS version; Apple documents iPadOS 16.1. inferred Evidence status: insufficient Apple Mobile Device Management has become even more secure with the rollout of Managed Device Attestation in OS 16 (including iOS 16, iPadOS 16, and tvOS 16).Jamf Blog: Apple Managed Device Attestation and Jamf; What is Managed Device Attestation? iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents Managed Device Attestation as a feature of iOS 16, iPadOS 16.1, macOS 14, tvOS 16, or later. vendor_documented Evidence status: supported Managed Device Attestation is a feature for devices with iOS 16, iPadOS 16.1, macOS 14, tvOS 16, or later.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation for Apple devices (introduction) iOS 16 or later and iPadOS 16.1 or later; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that when Attest is true the device provides attestations describing the device and the generated key to the ACME server. vendor_documented Evidence status: supported If true, the device provides attestations describing the device and the generated key to the ACME server.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table) iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that Attest set to TRUE requires HardwareBound set to TRUE. vendor_documented Evidence status: supported When Attest is set to TRUE, HardwareBound also needs to be set to TRUE.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table) iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that with HardwareBound the Secure Enclave generates the key pair and the private key is entangled with a system key. vendor_documented Evidence status: supported The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Hardware bound (settings table) iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents the A11 Bionic chip or later as the hardware requirement for attestation on iPhone, iPad and Apple TV. vendor_documented Evidence status: supported With the A11 Bionic chip or later.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Supported hardware for Managed Device Attestation iOS and iPadOS on devices with the A11 Bionic chip or later; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple's developer hardware support table lists A11 Bionic and later and all M series chips as supporting the Attest key on iPhone and iPad. vendor_documented Evidence status: supported \|Supported \|A11 Bionic and later<br>All M series\|Apple silicon \|A12 Bionic and later \|S4 and later \|All \|Apple Developer Documentation: ACMECertificate \| Apple Developer Documentation (Device Management); ACME attestation hardware support iOS and iPadOS on devices with the A11 Bionic chip or later or any M series chip; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple's developer guidance states that the ACME service receives the attestation certificate chain in the device-attest-01 challenge response, which makes the ACME CA the attestation verifier. vendor_documented Evidence status: supported Your ACME service receives the attestation certificate chain when the device responds to the `device-attest-01` challenge.Apple Developer Documentation: Validating a Managed Device Attestation \| Apple Developer Documentation (Device Management); Validate an ACME attestation iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that hardware-bound keys are removed when a device is erased or restored and that the profile must be applied again to recreate them. vendor_documented Evidence status: supported These hardware-bound keys are automatically removed when erasing or restoring a device. Because the keys are removed, any configuration profiles relying on those keys won’t work after a restore. The profile needs to be applied again to get the keys recreated.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation with ACME certificate enrollment requests iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf's release announcement for Jamf Pro 11.19 (July 31, 2025) states that Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before expiry. vendor_documented Evidence status: supported You can configure Jamf Pro to automatically redistribute ACME certificates to computers and mobile devices at a specified number of days before the certificates expire.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that iOS, iPadOS and macOS supplicants send the certificate identity common name to the RADIUS server during 802.1X negotiation, which names the RADIUS server as the relying party. vendor_documented Evidence status: supported By default, iOS, iPadOS, and macOS supplicants use the certificate identity common name for the EAP Response Identity it sends to the RADIUS server during 802.1X negotiation.Apple Platform Deployment: Connect Apple devices to 802.1X networks - Apple Support (UK); EAP types iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan

application authentication

1 workflow

Jamf Pro: application authentication workflows · enrollment management and issuing CA shown separately
Workflow	Signed issuer	Managing platform	Key protection	Attestation evidence	Status
macOS · SCEP profileapplication authentication · SCEP gateway	Smallstep	Jamf Pro	not documented by the vendor	not documented by the vendor	supportedVerified 2026-10-29
Requirements, limitations and evidence 4 cited claims Workflow reference: `wf-smallstep-jamf-macos-agent-bootstrap-scep` On macOS managed by Jamf Pro, a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose application authentication Enrollment method SCEP profile Enrollment service SCEP gateway Issuer type third-party CA Key protection not documented by the vendor Attestation evidence not documented by the vendor Verification type vendor documented Prerequisites Jamf Pro connected to Smallstep; SCEP enrollment webhook configured in Jamf Pro; Smallstep-generated jamf-<connection-id>.mobileconfig uploaded to Jamf. Notes and documented limits Bootstrap credential only. Core Concepts describes the SCEP certificate issued via MDM as a provisional identity used to bootstrap with the Smallstep platform. Key protection and renewal of this bootstrap certificate are not stated on the Jamf page. Evidence for wf-smallstep-jamf-macos-agent-bootstrap-scep (4 claims) The downloaded profile is named jamf-<connection-id>.mobileconfig. vendor_documented Evidence status: supported The downloaded file is named jamf-<connection-id>.mobileconfig.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure an agent enrollment profile macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. The SCEP payload in the agent enrollment profile relies on the dynamic challenge served by the SCEP enrollment webhook. vendor_documented Evidence status: supported The SCEP payload relies on the dynamic challenge served by the SCEP enrollment webhook you configured earlier, so that webhook must be in place for enrollment to succeed.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure an agent enrollment profile macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Smallstep states it may use ACME or SCEP for certificate enrollment for compatibility reasons. vendor_documented Evidence status: supported For compatibility reasons, Smallstep may use ACME or SCEP for certificate enrollment.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure a SCEP enrollment webhook in Jamf Pro macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Core Concepts describes the SCEP certificate issued via MDM as the provisional identity the agent uses to bootstrap. vendor_documented Evidence status: supported The Smallstep Agent uses a provisional identity (eg. an SCEP certificate issued via MDM) to bootstrap with the Smallstep platform.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA). Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan

MDM identity

4 workflows

Jamf Pro: MDM identity workflows · enrollment management and issuing CA shown separately
Workflow	Signed issuer	Managing platform	Key protection	Attestation evidence	Status
macOS · SCEP profileMDM identity · none (documented absence)	third-party CA	Jamf Pro	not documented by the vendor	none (documented absence)	supportedVerified 2026-10-29
Requirements, limitations and evidence 4 cited claims Workflow reference: `wf-jamf-pro-macos-mdm-identity-scep-external-ca` On macOS managed by Jamf Pro, a MDM identity certificate enrolled by SCEP profile through none (documented absence) and issued by third-party CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose MDM identity Enrollment method SCEP profile Enrollment service none (documented absence) Issuer type third-party CA Key protection not documented by the vendor Attestation evidence none (documented absence) Verification type vendor documented Prerequisites An organizational or third-party CA that supports SCEP, selected in PKI Certificates as the SCEP-enabled external CA for computer and mobile device enrollment. Selecting this option requires re-enrolling all devices with Jamf Pro. Renewal behavior for this option is not documented on the pages retrieved. Notes and documented limits Jamf documents that a SCEP-capable organizational or third-party CA can issue the management certificates, and that the device communicates with the SCEP server directly when it checks in. Jamf's page does not name a specific CA product for this option. Key protection is not documented by Jamf or Apple for SCEP-issued identities. Evidence for wf-jamf-pro-macos-mdm-identity-scep-external-ca (4 claims) Jamf documents that an organizational or third-party CA that supports SCEP can issue the management certificates to computers and mobile devices. vendor_documented Evidence status: supported If you are using an organizational or third-party CA that supports SCEP, you can use it to issue management certificates to computers and mobile devices.Jamf Learning Hub: External CAs - Jamf Pro Documentation 11.33.0; Meta description (article body not rendered) macOS; MDM device identity; SCEP enrollment request in the MDM profile; no enrollment service (device contacts the SCEP server directly); SCEP-enabled organizational or third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that with an external CA for management certificates, the device communicates with the SCEP server to obtain the certificate when it checks in with Jamf Pro. vendor_documented Evidence status: supported When a device checks in with Jamf Pro, the device communicates with the SCEP server to obtain the certificate.Jamf Learning Hub: External CAs - Jamf Pro Documentation 11.33.0; Meta description (article body not rendered) macOS; MDM device identity; SCEP enrollment request in the MDM profile; no enrollment service (device contacts the SCEP server directly); SCEP-enabled organizational or third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that selecting the SCEP-enabled external CA option for enrollment requires re-enrolling all devices with Jamf Pro. vendor_documented Evidence status: supported Selecting this option requires you to re-enroll all devices with Jamf Pro.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Important macOS; MDM device identity; SCEP enrollment request in the MDM profile; no enrollment service (device contacts the SCEP server directly); SCEP-enabled organizational or third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation. vendor_documented Evidence status: supported Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro) macOS; MDM device identity; SCEP enrollment request in the MDM profile; no enrollment service (device contacts the SCEP server directly); SCEP-enabled organizational or third-party CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
macOS · SCEP profileMDM identity · native MDM enrollment	platform CA	Jamf Pro	not documented by the vendor	none (documented absence)	supportedVerified 2026-10-29
Requirements, limitations and evidence 8 cited claims Workflow reference: `wf-jamf-pro-macos-mdm-identity-scep-builtin-ca` On macOS managed by Jamf Pro, a MDM identity certificate enrolled by SCEP profile through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29). Operating system macOS Certificate purpose MDM identity Enrollment method SCEP profile Enrollment service native MDM enrollment Issuer type platform CA Key protection not documented by the vendor Attestation evidence none (documented absence) Verification type vendor documented Prerequisites Jamf Pro built-in CA selected for computer and mobile device enrollment (the default; the alternative is a SCEP-enabled external CA, which requires re-enrolling all devices). The built-in CA supports SCEP. MDM profile renewal settings control automatic renewal of the MDM profile and device identity certificate. Notes and documented limits Jamf documents the device identity certificate in the MDM profile and the built-in CA as the enrollment CA. The SCEP enrollment request inside the MDM profile is stated explicitly for mobile devices; for computers it is stated through the built-in CA SCEP support and the shared computer and mobile device enrollment setting. Key protection is not documented by Jamf or Apple for SCEP-issued identities. Evidence for wf-jamf-pro-macos-mdm-identity-scep-builtin-ca (8 claims) Jamf documents the Jamf Pro built-in CA as the certificate authority used for computer and mobile device enrollment, with a SCEP-enabled external CA as the alternative enrollment option. vendor_documented Evidence status: supported If you are using the Jamf Pro built-in CA for device enrollment, ensure that you do not select Use a SCEP-enabled external CA for computer and mobile device enrollment.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Important macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that the MDM profile on enrolled computers and mobile devices contains a device identity certificate whose expiry stops MDM functionality. vendor_documented Evidence status: supported The device identity certificate in the MDM profile expires and prevents MDM functionality from working.Jamf Learning Hub: Enrolled Devices Stop Communicating after 5 Years - Technical Articles; Meta description (article body not rendered) macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that the CA hosted by Jamf Pro, the built-in CA, supports SCEP. vendor_documented Evidence status: supported The CA hosted by Jamf Pro (the “built-in CA”) supports SCEP.Jamf: Jamf Pro Administrator's Guide Version 10.28.0; Security > Simple Certificate Enrollment Protocol macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA; statement taken from the Jamf Pro 10.28.0 administrator's guide Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that device identity certificates let Jamf Pro verify the identity of computers and mobile devices on each communication with the Jamf Pro server, which identifies the Jamf Pro server as the relying party. vendor_documented Evidence status: supported Device identity certificates allow Jamf Pro to verify the identity of computers and mobile devices each time they communicate with the Jamf Pro server.Jamf: Jamf Pro Administrator's Guide Version 10.28.0; Security > Certificates macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA; statement taken from the Jamf Pro 10.28.0 administrator's guide Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents the PKI Certificates settings as the place where the PKI used between computers, mobile devices and certificate authorities is managed. vendor_documented Evidence status: supported The PKI Certificates settings allow you to manage the public key infrastructure needed to establish communication between computers and mobile devices and certificate authorities (CA).Jamf Learning Hub: PKI Certificates - Jamf Pro Documentation 11.30.0; Meta description (article body not rendered) macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents MDM profile settings that configure when MDM profiles are automatically renewed for computers and mobile devices, which places renewal of the MDM identity with Jamf Pro. vendor_documented Evidence status: supported Configure when MDM profiles are automatically renewed for computers and mobile devices using the following settings:Jamf Learning Hub: Configuring MDM Profile Renewal for Computers or Mobile Devices - Jamf Pro Documentation 11.16.0; Meta description (article body not rendered) macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that device identity certificates in the MDM profile expire five years after enrollment for devices enrolled in Jamf Pro 10.22.1 or earlier. vendor_documented Evidence status: supported Device identity certificates in the MDM profile expires five years after computers or mobile devices are enrolled in Jamf Pro 10.22.1 or earlier.Jamf Learning Hub: Renewing a Device Identity Certificate - Technical Articles; Meta description (article body not rendered) macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA; enrollments made on Jamf Pro 10.22.1 or earlier Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation. vendor_documented Evidence status: supported Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro) macOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
iOS · SCEP profileMDM identity · native MDM enrollment	platform CA	Jamf Pro	not documented by the vendor	none (documented absence)	supportedVerified 2026-10-29
Requirements, limitations and evidence 5 cited claims Workflow reference: `wf-jamf-pro-ios-mdm-identity-scep-builtin-ca` On iOS managed by Jamf Pro, a MDM identity certificate enrolled by SCEP profile through native MDM enrollment and issued by platform CA: key protection not documented by the vendor, no attestation evidence (documented absence), renewal by MDM, support status supported (vendor documented, verified 2026-10-29). Operating system iOS Certificate purpose MDM identity Enrollment method SCEP profile Enrollment service native MDM enrollment Issuer type platform CA Key protection not documented by the vendor Attestation evidence none (documented absence) Verification type vendor documented Prerequisites Jamf Pro built-in CA selected for computer and mobile device enrollment (the default). The MDM profile installed on mobile devices during enrollment includes a SCEP enrollment request and an MDM enrollment request. MDM profile renewal settings control automatic renewal. Notes and documented limits Jamf states that the MDM profile installed on mobile devices includes a SCEP enrollment request, and that the built-in CA is the default enrollment CA. Key protection is not documented by Jamf or Apple for SCEP-issued identities. Evidence for wf-jamf-pro-ios-mdm-identity-scep-builtin-ca (5 claims) Jamf documents that the MDM profile installed on mobile devices during enrollment includes a SCEP enrollment request and an MDM enrollment request. vendor_documented Evidence status: supported This profile includes a SCEP enrollment request and an MDM enrollment request.Jamf Learning Hub: Components Installed on Mobile Devices - Jamf Pro Documentation 11.33.0; Meta description (article body not rendered) iOS and iPadOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents the Jamf Pro built-in CA as the certificate authority used for computer and mobile device enrollment, with a SCEP-enabled external CA as the alternative enrollment option. vendor_documented Evidence status: supported If you are using the Jamf Pro built-in CA for device enrollment, ensure that you do not select Use a SCEP-enabled external CA for computer and mobile device enrollment.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Important iOS and iPadOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents that the MDM profile on enrolled devices contains a device identity certificate whose expiry stops MDM functionality. vendor_documented Evidence status: supported The device identity certificate in the MDM profile expires and prevents MDM functionality from working.Jamf Learning Hub: Enrolled Devices Stop Communicating after 5 Years - Technical Articles; Meta description (article body not rendered) iOS and iPadOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf documents MDM profile settings that configure when MDM profiles are automatically renewed for computers and mobile devices. vendor_documented Evidence status: supported Configure when MDM profiles are automatically renewed for computers and mobile devices using the following settings:Jamf Learning Hub: Configuring MDM Profile Renewal for Computers or Mobile Devices - Jamf Pro Documentation 11.16.0; Meta description (article body not rendered) iOS and iPadOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation. vendor_documented Evidence status: supported Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro) iOS and iPadOS; MDM device identity; SCEP enrollment request in the MDM profile; Jamf Pro (mdm_native); Jamf Pro built-in CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan
macOS · ACME device-attestation payloadMDM identity · ACME service	any compatible issuer	Jamf Pro	not documented by the vendor	not documented by the vendor	unknownVerified 2026-10-29
Requirements, limitations and evidence 2 cited claims Workflow reference: `wf-jamf-pro-macos-mdm-identity-acme-da` On macOS managed by Jamf Pro, a MDM identity certificate enrolled by ACME device-attestation payload through ACME service and issued by any compatible issuer: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status unknown (unknown, verified 2026-10-29). Operating system macOS Certificate purpose MDM identity Enrollment method ACME device-attestation payload Enrollment service ACME service Issuer type any compatible issuer Key protection not documented by the vendor Attestation evidence not documented by the vendor Verification type unknown Prerequisites Apple documents provisioning the enrollment identity through an ACME payload in the enrollment profile (macOS 14 or later, Apple silicon). Jamf's retrieved documentation describes enrollment with the Jamf Pro built-in CA or a SCEP-enabled external CA and does not describe an ACME enrollment identity. Notes and documented limits Apple documents the deployment model; no Jamf page retrieved in this pass documents ACME or Managed Device Attestation for the Jamf Pro MDM enrollment certificate itself. Jamf's payload support is documented for configuration profile certificates. Filed as unknown; sources consulted are listed in notes.md. Evidence for wf-jamf-pro-macos-mdm-identity-acme-da (2 claims) Apple documents a deployment model in which the MDM enrollment identity is provisioned through an ACME payload in the enrollment profile. vendor_documented Evidence status: insufficient To use this deployment model, the identity is provisioned at enrollment time by providing the device an enrollment profile including an ACME payloadApple Platform Deployment: Deploy Managed Device Attestation - Apple Support; Secure the device management channel deployment model macOS; MDM device identity; ACME payload with attestation in the enrollment profile; Jamf Pro with an ACME service; any ACME CA; Apple documentation only, Jamf support not established Last checked: 2026-10-29. Retrieved: 2026-10-29. Jamf's retrieved documentation describes device enrollment with the Jamf Pro built-in CA or a SCEP-enabled external CA and does not describe an ACME or attested enrollment identity; the absence is an inference from the pages retrieved. inferred Evidence status: insufficient If you are using the Jamf Pro built-in CA for device enrollment, ensure that you do not select Use a SCEP-enabled external CA for computer and mobile device enrollment.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Important macOS; MDM device identity; ACME payload with attestation in the enrollment profile; Jamf Pro with an ACME service; any ACME CA Last checked: 2026-10-29. Retrieved: 2026-10-29. Last materially updated 2026-10-29 Evidence last checked 2026-10-29 Verified on 2026-10-29 Verified by Daniel Michan

Sources

Platform Core Security Concepts Explained
Smallstep documentation · Retrieved 2026-10-29
Install the Smallstep Agent on macOS, Windows, and Linux
Smallstep documentation · Retrieved 2026-10-29
Integrate Jamf Pro with Smallstep Tutorial
Smallstep documentation · Retrieved 2026-10-29
Deploy EAP-TLS Wi-Fi certificates to Apple devices with Smallstep and Jamf Pro
Smallstep documentation · Retrieved 2026-10-29
Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep
Smallstep documentation · Retrieved 2026-10-29
Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy
Jamf Learning Hub · Retrieved 2026-10-29
Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro
Jamf Learning Hub · Retrieved 2026-10-29
Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro
Jamf Learning Hub · Retrieved 2026-10-29
External CAs - Jamf Pro Documentation 11.33.0
Jamf Learning Hub · Retrieved 2026-10-29
Components Installed on Mobile Devices - Jamf Pro Documentation 11.33.0
Jamf Learning Hub · Retrieved 2026-10-29
PKI Certificates - Jamf Pro Documentation 11.30.0
Jamf Learning Hub · Retrieved 2026-10-29
Configuring MDM Profile Renewal for Computers or Mobile Devices - Jamf Pro Documentation 11.16.0
Jamf Learning Hub · Retrieved 2026-10-29
Renewing a Device Identity Certificate - Technical Articles
Jamf Learning Hub · Retrieved 2026-10-29
Enrolled Devices Stop Communicating after 5 Years - Technical Articles
Jamf Learning Hub · Retrieved 2026-10-29
Jamf Pro Administrator's Guide Version 10.28.0
Jamf · Retrieved 2026-10-29
Jamf Pro 11.7 Now Available
Jamf Nation Community (Release Announcements) · Retrieved 2026-10-29
Jamf Pro 11.19 Now Available
Jamf Nation Community (Release Announcements) · Retrieved 2026-10-29
Apple Managed Device Attestation and Jamf
Jamf Blog · Retrieved 2026-10-29
Managed Device Attestation for Apple devices - Apple Support
Apple Platform Deployment · Retrieved 2026-10-29
Deploy Managed Device Attestation - Apple Support
Apple Platform Deployment · Retrieved 2026-10-29
Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support
Apple Platform Deployment · Retrieved 2026-10-29
SCEP device management payload settings for Apple devices - Apple Support
Apple Platform Deployment · Retrieved 2026-10-29
Distribute certificates to Apple devices - Apple Support
Apple Platform Deployment · Retrieved 2026-10-29
Connect Apple devices to 802.1X networks - Apple Support (UK)
Apple Platform Deployment · Retrieved 2026-10-29
Intro to certificate management for Apple devices - Apple Support (UK)
Apple Platform Deployment · Retrieved 2026-10-29
The Secure Enclave - Apple Support
Apple Platform Security · Retrieved 2026-10-29
ACMECertificate | Apple Developer Documentation (Device Management)
Apple Developer Documentation · Retrieved 2026-10-29
Validating a Managed Device Attestation | Apple Developer Documentation (Device Management)
Apple Developer Documentation · Retrieved 2026-10-29

Does Jamf Pro support certificate enrollment and device attestation?

Wi-Fi EAP-TLS

Prerequisites

Notes and documented limits

Jamf documents that the connector's outbound communication mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later.

Jamf documents that the Jamf AD CS Connector can be configured in Jamf Pro using either the SCEP payload or the Certificate payload.

Jamf documents that SCEP payload certificate traffic flows through Jamf Pro and then to AD CS when the AD CS integration is used.

Jamf documents distributing AD CS certificates to computers and mobile devices through configuration profiles once Jamf Pro and AD CS communicate through the connector.

Jamf documents a Redistribute Profile option on the SCEP payload with AD CS that redistributes the profile a chosen number of days before the certificate expires, which places renewal with Jamf Pro.

Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.

Prerequisites

Notes and documented limits

The Smallstep Agent is not required on the device in the Jamf SCEP path.

Jamf deploys a profile that establishes CA trust, obtains a client certificate from the Smallstep SCEP server with dynamic single-use challenges, and configures Wi-Fi.

No Jamf SCEP proxy is needed because the Smallstep hosted CA is reachable from the public internet.

A SCEP Challenge webhook is added to the Jamf tenant configuration.

The Jamf webhook event is SCEPChallenge.

The SCEP enrollment webhook lets Jamf request a dynamic, short-lived challenge string from Smallstep during the SCEP request.

The device should already be enrolled with a basic Jamf MDM profile.

The Jamf SCEP setup guide is for Device or Computer Level MDM profiles, not User Level profiles.

The page contrasts the SCEP path with ACME-DA, where the private key is hardware-bound, and does not state key protection for the SCEP path.

Prerequisites

Notes and documented limits

After installation the certificate Subject Common Name contains the serial number and the Hardware Bound property reads Yes.

Core Concepts states Smallstep can be used on Apple platforms without the agent, with no bootstrapping, when the device is in inventory and marked trusted.

Core Concepts describes device attested keys as proving a specific key is on a specific device, including proof of the serial number or other hardware identifier.

The Connect Jamf Pro page documents inventory sync from Jamf to Smallstep with a partial sync every hour and a full sync every 8 hours.

The device must have a user assigned and must be approved before it can obtain a certificate through ACME-DA.

Smallstep documents replacing SCEP with ACME Device Attestation on macOS with Jamf, with a hardware-bound private key and Apple attestation of the request origin.

In this path Jamf manages all settings and the Smallstep Agent is not involved.

The device must already be synced from Jamf into the Smallstep inventory because ACME-DA requests are checked against the serial number.

The ACME Certificate payload uses $SERIALNUMBER as Client identifier, Key Size 384, Key Type ECSECPrimeRandom, Hardware Bound True and Attest True.

The ACME directory URL field takes the device authority ACME-DA provisioner URL.

The profile is a Computer Level profile with Install automatically as the distribution method.

The Network payload selects the ACME Certificate as the identity certificate with TLS as the accepted EAP type.

The issued certificate does not appear in the Keychain application and is inspected with mdmclient QueryCertificates.

Core Concepts states that Apple limits hardware attestations to the Managed Device Attestation workflow using ACME DA, available only to managed devices in Supervised mode.

In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the macOS (agentless) column.

The columns of that table are macOS (Smallstep agent), macOS (agentless), Windows, Linux and ChromeOS.

Apple documents that Attest set to TRUE requires HardwareBound set to TRUE.

Apple documents that with HardwareBound the Secure Enclave generates the key pair and the private key is entangled with a system key.

Apple's developer hardware support table lists the Attest key as Ignored for T2 Macs, so a T2 Mac yields no attestation to the ACME server.

Apple documents that attestations are issued to Mac computers with Apple silicon.

Prerequisites

Notes and documented limits

The Jamf SCEP section heading names macOS and iOS, and the workflow obtains a client certificate from the Smallstep SCEP server with dynamic single-use challenges.

The Smallstep Agent is not required on the device.

The Jamf SCEP setup guide is for Device or Computer Level MDM profiles, not User Level profiles.

The page contrasts SCEP with the macOS ACME-DA path, where the private key is hardware-bound, and does not state key protection for the iOS SCEP path.

Prerequisites

Notes and documented limits

The agent requires macOS 13 or later, Apple Silicon M1 or later, and single-user installation.

Core Concepts states that on Apple platforms the agent emulates TPM remote key attestation and that this is not device attestation.

The Jamf integration deploys a Smallstep-generated configuration profile that enrolls devices using the Smallstep Agent.

The downloaded profile bundles the SCEP payload, root and intermediate CA certificates, agent settings and the Login Items entry.

The Jamf integration requires a Smallstep team with Pro features, a Jamf Pro tenant and a package distribution point.

The agent can be installed via Jamf package distribution and policy or separately with another tool or scripts.

Location permission is required when the agent manages Wi-Fi network configurations on macOS.

The agent requests the client certificate with the private key generated in the device secure hardware.

The agent renews the certificate automatically before it expires and creates the EAP-TLS Wi-Fi profile.

In the Core Concepts key attestation level table, the Wi-Fi row reads Smallstep attested for the macOS (Smallstep agent) column.

In the Smallstep attested workflow the private key is generated in the Secure Enclave and the public key is sent to the Smallstep attestation authority.

The Smallstep attestation certificate attests possession of the private key but cannot prove the key is in a genuine Apple Secure Enclave.

Core Concepts describes an optional hardware protection with fallback approach that uses the highest key protection level available.

The HARDWARE_ATTESTED credential setting generates the key in the TPM or Secure Enclave and requires remote attestation.

Prerequisites

Notes and documented limits

Jamf documents that only one NDES server can be specified when Jamf Pro is used as the SCEP proxy.

Jamf documents that configuration profile certificate payloads provide user access to resources such as VPN or Wi-Fi, which names the relying parties for these certificates.

Jamf documents that with Jamf Pro enabled as SCEP proxy, Jamf Pro communicates with the SCEP server and installs the certificate on computers or mobile devices.

Jamf documents that Jamf Pro as SCEP proxy must be enabled in the PKI Certificate settings before a configuration profile can be distributed with it.

Jamf names a Microsoft certificate authority SCEP instance (SERVERNAME-MSCEP-RA) as the example for the SCEP proxy instance name.

Jamf documents that the SCEP challenge password is used as the pre-shared secret for automatic enrollment when the Static challenge type is chosen.

Jamf documents that an external CA used with the SCEP proxy requires the signing and CA certificates to be provided to Jamf Pro after saving.

Jamf lists SCEP through Microsoft Network Device Enrollment Service (NDES) as an AD CS integration method, and the same list item states that it can use the Jamf Pro SCEP proxy feature.

Jamf documents a Redistribute Profile option on the SCEP payload that redistributes the configuration profile a chosen number of days before the certificate expires, which places renewal with Jamf Pro.

Apple documents that the certificate identity for EAP-TLS 802.1X authentication can come from a SCEP payload, among other payloads.

Apple documents the RADIUS server as the counterpart in the 802.1X negotiation with the device supplicant.

Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.

Apple documents the SCEP payload as the setting that lets the device obtain certificates from a certificate authority using SCEP.