Device Identity Index

Can Jamf Pro issue hardware-attested certificates to Macs, and which CA verifies the attestation?

Yes, on Apple silicon Macs running macOS 14 or later, through the ACME certificate payload with Attest and HardwareBound set, and the verifier is the ACME CA behind the directory URL, which must handle the device-attest-01 challenge and validate Apple's attestation chain before finalize. Jamf delivers the payload and, from 11.19, redistributes it before expiry; it does not verify anything itself. Use EC P-256 or P-384 keys, plan for hardware-bound keys to disappear on erase, and expect the certificate not to show in Keychain Access. Where attestation is not required, the built-in CA or the SCEP proxy to AD CS remain documented and simpler, and the ACME payload without Attest sits between them.

Answer: conditional · Last reviewed 2026-10-29

Who this applies to

Mac administrators on Jamf Pro who need the Wi-Fi or VPN certificate key verified as hardware-bound by the issuer, and PKI teams choosing the CA for it.

The problem

Jamf Pro can deliver certificates to Macs four ways, and only one of them can carry Apple's attestation. The built-in CA and the SCEP proxy work over SCEP, which Apple excludes from Managed Device Attestation. The ACME certificate payload, available since Jamf Pro 11.7, carries attestation only when Attest and HardwareBound are set and the CA behind the ACME directory URL handles the device-attest-01 challenge. The verifier is that CA, not Jamf.

Decision rule

  1. Is attestation verified by the CA required, or is a device-generated key enough?
  2. Fleet hardware and OS: Apple silicon and macOS 14 or later for attestation; T2 Macs yield none.
  3. Issuer: does the chosen CA expose an ACME directory that supports device-attest-01 and validates Apple attestation chains, or is the issuer AD CS or Jamf's built-in CA?
  4. Key algorithm: hardware-bound keys are EC 256 or 384; RSA cannot be hardware-bound in the ACME payload.
  5. Renewal and erase behavior: who redistributes before expiry, and what happens to hardware-bound keys on erase.

Options

Options and documented limits
OptionHow it worksLimitsWhen it fitsEvidence type
ACME certificate payload with Attest to a third-party ACME CAJamf Pro delivers Apple's ACME certificate payload; with Attest true the device provides attestations describing the device and the generated key, the Secure Enclave generates the key pair, and the ACME service receives the attestation chain in the device-attest-01 response and proceeds to finalize only after validation. Jamf Pro 11.19 adds automatic redistribution of ACME certificates before expiry. A documented CA setup uses $SERIALNUMBER as client identifier, EC P-384, Hardware Bound true and Attest true, and checks the request against the device inventory.Apple silicon and macOS 14 or later; T2 Macs are listed as Attest ignored; EC keys only; hardware-bound keys are removed on erase or restore and the profile must be reapplied; the issued certificate does not appear in Keychain Access in the documented setup; automatic redistribution requires the CA template to accept an OU value. Jamf's own documentation page for the payload settings was not retrievable in this review, so Jamf-side exposure of the Attest setting rests on Jamf's release note, a Jamf blog and a CA vendor's tutorial.The relying party needs CA-verified attestation and the fleet is Apple silicon on macOS 14 or later.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented
ACME certificate payload without AttestThe same payload with Attest false: the private key stays on the device and can optionally be hardware-bound, and the ACME server receives no attestation.No verification by the CA of where the key lives; the CA still has to support the device-attest-01 challenge flow Apple's client uses.A device-generated, optionally hardware-bound key is enough and the CA supports ACME for Apple devices.vendor_documented, vendor_documented, vendor_documented, vendor_documented
SCEP through the Jamf built-in CAJamf Pro's built-in CA supports SCEP and issues to configuration profile certificate payloads with no further action after enabling Jamf Pro as SCEP proxy.Apple documents that Managed Device Attestation requires ACME, so a SCEP-issued identity carries no attestation; key generation location is not documented by Jamf.No external CA, no attestation requirement.vendor_documented, vendor_documented, vendor_documented
SCEP through the Jamf SCEP proxy or the Jamf AD CS Connector to AD CSJamf Pro communicates with the SCEP server (NDES on AD CS) and installs the certificate, or the AD CS Connector carries SCEP payload traffic through Jamf Pro to AD CS; a Redistribute Profile option renews before expiry.SCEP, so no attestation; one NDES server when Jamf Pro is the proxy; connector outbound mode needs Jamf Pro 11.13 and connector 2.0.AD CS must stay the issuer and attestation is not required.vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented

Strongest alternative

The ACME payload without Attest came closest: it is the same payload, works on the same Jamf versions, and can still produce a hardware-bound key. It is not selected where attestation is the requirement because Apple states the ACME server receives no attestation when Attest is false or ignored, so the CA has nothing to verify.

Recommended approach

Yes, on Apple silicon Macs running macOS 14 or later, through the ACME certificate payload with Attest and HardwareBound set, and the verifier is the ACME CA behind the directory URL, which must handle the device-attest-01 challenge and validate Apple's attestation chain before finalize. Jamf delivers the payload and, from 11.19, redistributes it before expiry; it does not verify anything itself. Use EC P-256 or P-384 keys, plan for hardware-bound keys to disappear on erase, and expect the certificate not to show in Keychain Access. Where attestation is not required, the built-in CA or the SCEP proxy to AD CS remain documented and simpler, and the ACME payload without Attest sits between them.

When another option is the better choice

Any ACME CA that supports device-attest-01 and validates Apple attestation chains fits identically from Jamf's side; the documented example here is one such CA. Where AD CS is the mandated issuer, the SCEP proxy or AD CS Connector is the documented path and attestation is not available on it. Where there is no external CA at all, the built-in CA covers non-attested certificates.

Recommended tools

Platforms and workflow records covered

Changes that affected this answer

  • No published changes linked.

What remains unverified

  • Jamf's own documentation of the Attest and Hardware Bound fields in the ACME payload UI: the learn.jamf.com page was not retrievable in this review; the capability is established by Jamf's 11.7 release note (payload exists), Apple's payload reference (the keys), a Jamf blog and a CA vendor tutorial (the fields in Jamf's UI).

Evidence for the options

Smallstep documents replacing SCEP with ACME Device Attestation on macOS with Jamf, with a hardware-bound private key and Apple attestation of the request origin.

vendor_documented Evidence status: supported

On macOS, you can replace SCEP with ACME Device Attestation (ACME-DA) for a higher-assurance workflow: the private key is hardware-bound, and Apple's attestation authority cryptographically proves the certificate request came from a specific, genuine Apple device.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation)

macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The device must already be synced from Jamf into the Smallstep inventory because ACME-DA requests are checked against the serial number.

vendor_documented Evidence status: supported

The device must already be synced from Jamf into your Smallstep inventory, because ACME-DA requests are checked against known device identifiers (the serial number, on macOS).Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation)

macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The ACME Certificate payload uses $SERIALNUMBER as Client identifier, Key Size 384, Key Type ECSECPrimeRandom, Hardware Bound True and Attest True.

vendor_documented Evidence status: supported

Set $SERIALNUMBER as the “Client identifier” Set 384 as the “Key Size” Select “ECSECPrimeRandom” as the “Key Type” Set “Hardware Bound” to “True” Set “Subject” to CN=$SERIALNUMBER Set “Extended Key Usage” to 1.3.6.1.5.5.7.3.2 Set “Attest” to “True”Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation)

macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

The issued certificate does not appear in the Keychain application and is inspected with mdmclient QueryCertificates.

vendor_documented Evidence status: supported

Due to how managed device attestation works on macOS, the issued certificate won't appear in the Keychain application; you can inspect it with sudo /usr/libexec/mdmclient QueryCertificates instead.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation)

macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that only one NDES server can be specified when Jamf Pro is used as the SCEP proxy.

vendor_documented Evidence status: supported

When using Jamf Pro as proxy, only one NDES server can be specified.Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Overview (feature comparison table footnote)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that the connector's outbound communication mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later.

vendor_documented Evidence status: supported

Outbound mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later.Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Jamf AD CS Connector Communication Modes

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector in outbound mode (mdm_native); Active Directory Certificate Services

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer reference states that the ACME server responds to the device's order with a device-attest-01 challenge, which the ACME CA must therefore support.

vendor_documented Evidence status: supported

The ACME server responds with a challenge type of `device-attest-01`.Apple Developer Documentation: ACMECertificate | Apple Developer Documentation (Device Management); Discussion

macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer reference states that the ACME server receives no attestation when the Attest key is false or ignored.

vendor_documented Evidence status: supported

If the Attest key is false or ignored, the ACME server does not receive an attestation.Apple Developer Documentation: ACMECertificate | Apple Developer Documentation (Device Management); ACME attestation hardware support

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest false; Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that Attest set to TRUE requires HardwareBound set to TRUE.

vendor_documented Evidence status: supported

When Attest is set to TRUE, HardwareBound also needs to be set to TRUE.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that with Jamf Pro enabled as SCEP proxy, Jamf Pro communicates with the SCEP server and installs the certificate on computers or mobile devices.

vendor_documented Evidence status: supported

Enabling Jamf Pro as SCEP Proxy for a configuration profile allows Jamf Pro to communicate with your SCEP server to install the certificate directly on computers or mobile devices.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf lists SCEP through Microsoft Network Device Enrollment Service (NDES) as an AD CS integration method, and the same list item states that it can use the Jamf Pro SCEP proxy feature.

vendor_documented Evidence status: supported

Simple Certificate Enrollment Protocol (SCEP) using Microsoft Network Device Enrollment Service (NDES)Jamf Learning Hub: Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Overview (integration methods list)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.

vendor_documented Evidence status: supported

Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that SCEP payload certificate traffic flows through Jamf Pro and then to AD CS when the AD CS integration is used.

vendor_documented Evidence status: supported

When certificates are distributed using the SCEP payload, traffic flows through Jamf Pro and then to AD CS.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (introduction)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro with the Jamf AD CS Connector (mdm_native); Active Directory Certificate Services

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents, within the procedure for enabling Jamf Pro as SCEP proxy for configuration profiles, that no further action is needed after saving when the Jamf Pro built-in CA is used.

vendor_documented Evidence status: supported

If you are using the Jamf Pro built-in CA, no action is necessary after saving.Jamf Learning Hub: Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy; Enabling Jamf Pro as SCEP Proxy for Configuration Profiles (closing paragraph)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Jamf Pro built-in CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf documents that the CA hosted by Jamf Pro, the built-in CA, supports SCEP.

vendor_documented Evidence status: supported

The CA hosted by Jamf Pro (the “built-in CA”) supports SCEP.Jamf: Jamf Pro Administrator's Guide Version 10.28.0; Security > Simple Certificate Enrollment Protocol

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Jamf Pro built-in CA; statement taken from the Jamf Pro 10.28.0 administrator's guide

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that Managed Device Attestation requires use of ACME, so a certificate identity obtained through a SCEP request carries no device attestation.

vendor_documented Evidence status: supported

Use of ACME is required when using Managed Device Attestation.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Automated Certificate Management Environment (ACME) device management payload settings for Apple devices (intro)

macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Jamf Pro built-in CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.

vendor_documented Evidence status: supported

The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support

macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that with ACME the private key stays on the device and can optionally be hardware bound, so key protection depends on the HardwareBound setting.

vendor_documented Evidence status: supported

With this technique, the private key remains only on the device, and can optionally be hardware bound to the device.Apple Platform Deployment: Distribute certificates to Apple devices - Apple Support; Certificate deployment methods that use device management configurations

macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf states that automatic redistribution of ACME certificates requires the ACME certificate authority template to accept an OU value, because Jamf Pro inserts a profile identifier as an organizational unit.

vendor_documented Evidence status: supported

Your ACME certificate authority template must also support the inclusion of an OU value to use this functionality.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates (Note)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf's release announcement for Jamf Pro 11.7 (July 9, 2024) states that the ACME Certificate payload obtains certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.

vendor_documented Evidence status: supported

The ACME Certificate payload is an alternative for SCEP and is used to obtain certificates from a certificate authority for computers and mobile devices enrolled with Jamf Pro.Jamf Nation Community (Release Announcements): Jamf Pro 11.7 Now Available; Automated Certificate Management Environment (ACME) payload support

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.7 or later with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

A Jamf blog post (October 27 2022) states that with a profile containing an ACME payload the device provides an attestation to the organization's ACME server; this is a vendor blog, not product documentation.

vendor_documented Evidence status: supported

With a profile containing an ACME payload, your device provides an attestation to an organization's ACME server.Jamf Blog: Apple Managed Device Attestation and Jamf; How does MDA work?

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that when Attest is true the device provides attestations describing the device and the generated key to the ACME server.

vendor_documented Evidence status: supported

If true, the device provides attestations describing the device and the generated key to the ACME server.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Attest (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that with HardwareBound the Secure Enclave generates the key pair and the private key is entangled with a system key.

vendor_documented Evidence status: supported

The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Hardware bound (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that hardware bound keys support only key sizes 256 and 384 (ECSECPrimeRandom key type).

vendor_documented Evidence status: supported

Hardware bound keys only support values of 256 and 384.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Key type (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that RSA key pairs in the ACME payload require HardwareBound FALSE, so an attested hardware-bound identity uses an EC key.

vendor_documented Evidence status: supported

RSA key pairs need to have a KeySize in the range [1024…4096] inclusive and a multiple of 8, and HardwareBound needs to be FALSE.Apple Platform Deployment: Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support; Key type (settings table)

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents Managed Device Attestation as a feature of iOS 16, iPadOS 16.1, macOS 14, tvOS 16, or later.

vendor_documented Evidence status: supported

Managed Device Attestation is a feature for devices with iOS 16, iPadOS 16.1, macOS 14, tvOS 16, or later.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation for Apple devices (introduction)

macOS 14 or later; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that attestations are issued to Mac computers with Apple silicon.

vendor_documented Evidence status: supported

Mac computers: With Apple silicon.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Supported hardware for Managed Device Attestation

macOS on Mac computers with Apple silicon; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer hardware support table lists the Attest key as Ignored for T2 Macs, so a T2 Mac yields no attestation to the ACME server.

vendor_documented Evidence status: supported

|Ignored |A10x Fusion and earlier |T2 |A10x Fusion and earlier|S3 and earlier|none |Apple Developer Documentation: ACMECertificate | Apple Developer Documentation (Device Management); ACME attestation hardware support

macOS on Intel Mac computers with the T2 chip; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer guidance states that the ACME service receives the attestation certificate chain in the device-attest-01 challenge response, which makes the ACME CA the attestation verifier.

vendor_documented Evidence status: supported

Your ACME service receives the attestation certificate chain when the device responds to the `device-attest-01` challenge.Apple Developer Documentation: Validating a Managed Device Attestation | Apple Developer Documentation (Device Management); Validate an ACME attestation

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple's developer guidance states that the ACME service proceeds to the finalize phase only after its validation steps succeed, which places the validation decision with the ACME CA.

vendor_documented Evidence status: supported

When all of the validation steps succeed, your ACME service can proceed to the `finalize` phase of the ACME protocol.Apple Developer Documentation: Validating a Managed Device Attestation | Apple Developer Documentation (Device Management); Validate an ACME attestation

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Apple documents that hardware-bound keys are removed when a device is erased or restored and that the profile must be applied again to recreate them.

vendor_documented Evidence status: supported

These hardware-bound keys are automatically removed when erasing or restoring a device. Because the keys are removed, any configuration profiles relying on those keys won’t work after a restore. The profile needs to be applied again to get the keys recreated.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation with ACME certificate enrollment requests

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Jamf's release announcement for Jamf Pro 11.19 (July 31, 2025) states that Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before expiry, which places renewal with Jamf Pro.

vendor_documented Evidence status: supported

You can configure Jamf Pro to automatically redistribute ACME certificates to computers and mobile devices at a specified number of days before the certificates expire.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates

macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true (acme_da_payload); Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA

Last checked: 2026-10-29. Retrieved: 2026-10-29.

Sources

  1. Platform Core Security Concepts Explained
    Smallstep documentation · Retrieved 2026-10-29
  2. Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep
    Smallstep documentation · Retrieved 2026-10-29
  3. Enabling Jamf Pro as SCEP Proxy for Configuration Profiles - Technical Paper: Enabling Jamf Pro as SCEP Proxy
    Jamf Learning Hub · Retrieved 2026-10-29
  4. Overview - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro
    Jamf Learning Hub · Retrieved 2026-10-29
  5. Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro
    Jamf Learning Hub · Retrieved 2026-10-29
  6. Jamf Pro Administrator's Guide Version 10.28.0
    Jamf · Retrieved 2026-10-29
  7. Jamf Pro 11.7 Now Available
    Jamf Nation Community (Release Announcements) · Retrieved 2026-10-29
  8. Jamf Pro 11.19 Now Available
    Jamf Nation Community (Release Announcements) · Retrieved 2026-10-29
  9. Apple Managed Device Attestation and Jamf
    Jamf Blog · Retrieved 2026-10-29
  10. Managed Device Attestation for Apple devices - Apple Support
    Apple Platform Deployment · Retrieved 2026-10-29
  11. Automated Certificate Management Environment (ACME) device management payload settings for Apple devices - Apple Support
    Apple Platform Deployment · Retrieved 2026-10-29
  12. Distribute certificates to Apple devices - Apple Support
    Apple Platform Deployment · Retrieved 2026-10-29
  13. The Secure Enclave - Apple Support
    Apple Platform Security · Retrieved 2026-10-29
  14. ACMECertificate | Apple Developer Documentation (Device Management)
    Apple Developer Documentation · Retrieved 2026-10-29
  15. Validating a Managed Device Attestation | Apple Developer Documentation (Device Management)
    Apple Developer Documentation · Retrieved 2026-10-29
Last materially updated
Not recorded
Evidence last checked
Not recorded
Verified on
2026-10-29
Verified by
Daniel Michan

Recommendations are editorial. About the publisher.