Does anybody know if there is a way to have OS X automatically use a specific AD certificate after an 802.1X AD Certificate payload has been delivered?
Let me provide the example...
- I have a JSS Computer Configuration Profile
- It has a network payload with the following details...
GENERAL:
Name: 802.1X AD Certificate
Description:
Category: Active Directory
Distribution Method: Install Automatically
Level: Computer
NETWORK:
Network Interface: WiFi
Service Set Identifier (SSID): my-company
Hidden Network: Unchecked
Auto Join: Checked
Proxy Setup: None
Security Type: WPA2 Enterprise
Use as a Login Window configuration: Unchecked
Network Security Settings: Protocols | Trust
Protocols
Accepted EAP Types: TLS
Use Directory Authentication: Unchecked
Username: N/A
Password: N/A
Verify Password: N/A
Identity Certificate: AD Certificate
Outer Identity: N/A
Trust
Trusted Certs: Checked - my-company-root-ca
Trusted Server Certificate Names: N/A
Allow Trust Exceptions: Unchecked
CERTIFICATE:
Certificate Name: my-company-root-ca
Certificate: Uploaded
Passphrase: N/A
Verify Passphrase: N/A
AD CERTIFICATE:
Description: My Company Network Access CA
Certificate Server: my-company-server-name
Certificate Authority: my-company Intermediate CA
Certificate Template: my-company-machine
Certificate Expiration Notification Threshold: 30
Prompt for Credentials: Unchecked
Username: N/A
Password: N.A
Verify Password: N/A
Allow access to all applications: Unchecked
Allow export from keychain: Unchecked
SCOPE:
Target Computers: Specific Computers
Target Users: Specific Users
Target: Test-Machine-01, Test-Machine-02
When the Computer Configuration Profile is pushed, the certificate is downloaded from AD and installed in the user's keychain.
The user is then prompted for the correct certificate before a connection to the Wireless network is established.
Is there a way to force the Configuration Profile to automatically use the correct certificate instead of relying on the user to select from the list of available certificates?
BONUS ROUND:
At some point in time, the certificate is going to expire.
The user should be prompted that the certificate is going to expire.
Is there a way to flush the expired cert and/or delete old, deprecated certs via the JSS?
Thanks!
