The MDM renews, or nothing does. On Jamf Pro 11.19 or later, enable automatic redistribution of ACME certificates with a lead time before expiry and make sure the CA template accepts the OU value Jamf inserts; on earlier versions, redistribute the profile on a schedule. On Intune there is no ACME Wi-Fi path to renew; SCEP certificates renew inside the threshold window only while the Mac is unlocked and syncing, and an expired one must be re-issued by removing and re-adding the device to the profile. For hardware-bound keys on any MDM, treat erase or restore as a certain re-issuance event because the key is gone. Where an agent issued the credential, the agent renews it and the MDM is not involved.
Answer: conditional · Last reviewed 2026-10-29
Mac and iOS administrators who have deployed, or plan to deploy, ACME certificate payloads and need to know what renews them and what breaks when nothing does.
An ACME certificate payload gets a device a certificate once. Apple places renewal of certificates delivered by a device management service on that service, and documents automatic renewal only for Active Directory certificates on macOS 13 or later. Whether an ACME certificate renews therefore depends on the MDM, and for hardware-bound keys the erase behavior matters too.
| Option | How it works | Limits | When it fits | Evidence type |
|---|---|---|---|---|
| Jamf Pro automatic redistribution of ACME certificates | From Jamf Pro 11.19 (July 31, 2025), Jamf Pro can automatically redistribute ACME certificates to computers and mobile devices a set number of days before they expire; the SCEP payload has had a Redistribute Profile option for the same purpose. | Requires the ACME CA template to accept an OU value, because Jamf Pro inserts a profile identifier as an organizational unit. Hardware-bound keys are removed on erase or restore and the profile must be reapplied. | Jamf-managed fleets on 11.19 or later with a CA template that tolerates the OU. | vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented, vendor_documented |
| Intune | Intune documents ACME only for the ADE management profile certificate on macOS 13.1 or later; for Wi-Fi it documents SCEP and PKCS profiles, where renewal is governed by the renewal threshold and, on macOS, happens only while the device is unlocked and syncing. | No ACME Wi-Fi certificate path is documented, so there is nothing to renew; renewal of the ADE ACME management certificate itself is not described by Microsoft; an expired SCEP certificate on macOS is not re-requested. | It does not apply to ACME Wi-Fi certificates on Intune today. | vendor_documented, vendor_documented, inferred, vendor_documented, vendor_documented |
| Agent-managed credentials | Where an agent requests the certificate itself, the vendor documents that the agent renews it automatically before expiry and recreates the Wi-Fi profile; the MDM's role is limited to delivering the agent and a bootstrap profile. | Applies to agent-issued credentials, not to an ACME payload the MDM delivered; renewal of the documented Jamf ACME-DA path is not described by the CA vendor and relies on Jamf's redistribution. | Fleets already running the agent, or where the MDM cannot redistribute. | vendor_documented, vendor_documented, vendor_documented |
Relying on the operating system to renew came closest to what administrators expect, because Apple does renew Active Directory certificates automatically on macOS 13 or later. Apple does not document the same for ACME payload certificates, and states instead that certificates deployed by a device management service need to be renewed by that service, so the operating system is not the answer.
The MDM renews, or nothing does. On Jamf Pro 11.19 or later, enable automatic redistribution of ACME certificates with a lead time before expiry and make sure the CA template accepts the OU value Jamf inserts; on earlier versions, redistribute the profile on a schedule. On Intune there is no ACME Wi-Fi path to renew; SCEP certificates renew inside the threshold window only while the Mac is unlocked and syncing, and an expired one must be re-issued by removing and re-adding the device to the profile. For hardware-bound keys on any MDM, treat erase or restore as a certain re-issuance event because the key is gone. Where an agent issued the credential, the agent renews it and the MDM is not involved.
Any MDM that documents redistribution of ACME payloads before expiry answers this the same way Jamf does; the OU requirement is Jamf-specific and other MDMs may impose other template conditions. Where no MDM redistribution exists, an agent that owns the credential is the documented alternative.
vendor_documented Evidence status: supported
ACME is supported on macOS 13.1 or later.Microsoft Learn: Overview of Apple Automated Device Enrollment for macOS in Intune; Certificates
macOS 13.1 or later; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
ADE supports the Automated Certificate Management Environment (ACME) protocol. When new devices enroll, the management profile from Intune receives an ACME certificate.Microsoft Learn: Overview of Apple Automated Device Enrollment for macOS in Intune; Certificates
macOS; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft
Last checked: 2026-10-29. Retrieved: 2026-10-29.
inferred Evidence status: insufficient
When new devices enroll, the management profile from Intune receives an ACME certificate.Microsoft Learn: Overview of Apple Automated Device Enrollment for macOS in Intune; Certificates
macOS 13.1 or later; MDM identity (management profile certificate); Automated Device Enrollment with ACME; Intune MDM native enrollment; Intune platform CA, issuer not named by Microsoft
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
Select the SCEP or PKCS client certificate profile that is also deployed to the device. This certificate is the identity that the device presents to the server to authenticate the connection.Microsoft Learn: Add Wi-Fi settings to Apple devices in Microsoft Intune; Enterprise profiles, EAP type, EAP-TLS, Certificates
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while synching with Intune.Microsoft Learn: Create and assign SCEP certificate profiles in Intune; Create a SCEP certificate profile, Configuration settings, Renewal threshold (%)
macOS; Wi-Fi EAP-TLS; SCEP certificate profile; Certificate Connector for Microsoft Intune with NDES; AD CS Enterprise CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
(Optional) If you want the configuration profile to be redistributed to devices before the certificate expires, select the number of days before the expiration date that you want from the Redistribute Profile pop-up menu.Jamf Learning Hub: Distributing AD CS Certificates Using the SCEP Payload - Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro; Distributing AD CS Certificates Using the SCEP Payload (step 9)
macOS; Wi-Fi EAP-TLS; SCEP payload in a configuration profile; Jamf Pro as SCEP proxy (mdm_native); Active Directory Certificate Services through NDES; documented on the AD CS SCEP payload page
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
You can configure Jamf Pro to automatically redistribute ACME certificates to computers and mobile devices at a specified number of days before the certificates expire.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates
macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
Your ACME certificate authority template must also support the inclusion of an OU value to use this functionality.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates (Note)
macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
To ensure ongoing service access, you need to renew any certificates you deploy using a device management service before they expire.Apple Platform Deployment: Distribute certificates to Apple devices - Apple Support; Renew certificates installed by configuration profiles
macOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
You can configure Jamf Pro to automatically redistribute ACME certificates to computers and mobile devices at a specified number of days before the certificates expire.Jamf Nation Community (Release Announcements): Jamf Pro 11.19 Now Available; Automatic Redistribution of ACME Certificates
iOS and iPadOS; Wi-Fi EAP-TLS; ACME Certificate payload without attestation; Jamf Pro 11.19 or later with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.
vendor_documented Evidence status: supported
These hardware-bound keys are automatically removed when erasing or restoring a device. Because the keys are removed, any configuration profiles relying on those keys won’t work after a restore. The profile needs to be applied again to get the keys recreated.Apple Platform Deployment: Managed Device Attestation for Apple devices - Apple Support; Managed Device Attestation with ACME certificate enrollment requests
macOS; Wi-Fi EAP-TLS; ACME Certificate payload with Attest true and HardwareBound true (acme_da_payload); Jamf Pro with the CA's ACME service; third-party ACME CA
Last checked: 2026-10-29. Retrieved: 2026-10-29.