Skip to main content
Question

On premise PKI with Unique Cert Per machine question

  • October 13, 2022
  • 2 replies
  • 13 views
5
Forum|alt.badge.img+7

Good morning,

So I'm not that familiar with certs, but we are setting up ISE system, and we need each machine to have its own trusted cert from our PKI.  While i use JAMF I'm not that familiar with Certs. I have read trough the below, but still not sure how to push out a Unique trusted cert to each MAC. I have done things with JAMFs internal CA for the mac but never an PKI.

https://docs.jamf.com/10.25.0/jamf-pro/administrator-guide/PKI_Certificates.html

Any Documentation or resources?

 

EDIT:

 

I did find the below. Would Setting up AD CS allow us to generate a Unique Cert Per machine?

 

https://docs.jamf.com/technical-papers/jamf-pro/integrating-ad-cs/10.40.0/Distributing_a_Certificate_Using_a_Configuration_Profile.html

    2 replies

    M
    Forum|alt.badge.img+9
    • merps
    • Contributor
    • 149 replies
    • October 13, 2022

    Yes AD CS will do what you need. Once it's set up, you'll use a config profile with something like CN=$SERIALNUMBER.domain.com in the subject field to help identify devices connecting through ISE.

     

    You can also use Jamf Pro as SCEP proxy if you already have NDES running somewhere on your network.

    5
    Forum|alt.badge.img+7
    • 5Y54DMIN
    • Author
    • Contributor
    • 42 replies
    • October 17, 2022

    Yes AD CS will do what you need. Once it's set up, you'll use a config profile with something like CN=$SERIALNUMBER.domain.com in the subject field to help identify devices connecting through ISE.

     

    You can also use Jamf Pro as SCEP proxy if you already have NDES running somewhere on your network.


    Hi @merps 

     

    So you are saying if i have  SCEP proxy and NDES then i don't need AD CS? 

    And in the SUBJECT in the Configuration profile for SCEP it can take variables? The Cert subject name is going to be Unique and the hostname of each machine. 

     

    I also reached out to JAMF Support and got the below answer, wanted to get your thoughts. 

     

    To start, below is the link to the documentation on integrating with Cisco ISE with Jamf Pro: https://docs.jamf.com/10.41.0/jamf-pro/documentation/Network_Integration.html However, for what we're trying to achieve, the integration with Cisco ISE will not be necessary. We can achieve this by ensuring we have everything configured as needed on the Cisco ISE side, and then choosing the workflow from the flowchart below: https://docs.jamf.com/technical-papers/jamf-pro/8021x/10.0.0/Overview.html We certainly can use variables for individual certificates on the Mac side using SCEP: https://docs.jamf.com/technical-papers/jamf-pro/scep-proxy/10.0.0/Overview.html


    Terms & ConditionsCookie settingsAccessibility statement