apple_device-management/declarative/declarations/assets/credentials/scep.yaml

title: SCEP Credential
description: A SCEP identity that the device generates.
payload:
  credentialtype: com.apple.credential.scep
  supportedOS:
    iOS:
      introduced: '17.0'
    macOS:
      introduced: '14.0'
    tvOS:
      introduced: '17.0'
    visionOS:
      introduced: '1.1'
    watchOS:
      introduced: '10.0'
payloadkeys:
- key: URL
  title: URL
  type: <string>
  presence: required
  content: The SCEP URL.
- key: Name
  title: Name
  type: <string>
  presence: optional
  content: Any string that the SCEP server recognizes. For example, it could be a
    domain name such as `example.org`. If a certificate authority has multiple CA
    certificates, you can use this field to specify the required certificate.
- key: Subject
  title: Subject
  type: <array>
  presence: optional
  content: |-
    The representation of an X.500 name is an array of OID and value. For example, `/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar` corresponds to:

    `[ [ ["C", "US"] ], [ ["O", "Apple Inc."] ], [ [ "CN", "foo"] ], [ [ "1.2.5.3", "bar" ] ] ]`

    You can represent OIDs as dotted numbers or use shortcuts for country (`C`), locality (`L`), state (`ST`), organization (`O`), organizational unit (`OU`), and common name (`CN`).
  subkeys:
  - key: SCEPSubjectArrayInnerArray
    title: Array inside SCEP subject array
    type: <array>
    subkeys:
    - key: SCEPSubjectArrayPair
      title: Subject array pair
      type: <array>
      subkeys:
      - key: SCEPSubjectArrayPairItem
        title: SCEP subject array pair item
        type: <string>
        repetition:
          min: 2
          max: 2
        content: One item in the array representing a pair of OID and value
- key: Challenge
  title: Challenge
  type: <string>
  presence: optional
  content: A preshared secret.
- key: Keysize
  title: Key size
  type: <integer>
  presence: optional
  rangelist:
  - 1024
  - 2048
  - 4096
  default: 1024
  content: The key size in bits, either `1024`, `2048`, or `4096`.
- key: Key Type
  title: Key type
  type: <string>
  presence: optional
  default: RSA
  content: The key type, which always has the value `RSA`.
- key: Key Usage
  title: Key usage
  type: <integer>
  presence: optional
  default: 0
  content: 'A bitmask that specifies the use of the key: `1` is signing, `4` is encryption,
    and `5` is both signing and encryption. Some certificate authorities, such as
    Windows CA, support only encryption or signing, but not both at the same time.'
- key: CAFingerprint
  title: Fingerprint
  type: <data>
  presence: optional
  content: The fingerprint of the Certificate Authority certificate.
- key: Retries
  title: Retries
  type: <integer>
  presence: optional
  default: 3
  content: The number of times the device should retry if the server sends a `PENDING`
    response.
- key: RetryDelay
  title: Retry delay
  type: <integer>
  presence: optional
  default: 10
  content: The number of seconds to wait between subsequent retries. The system makes
    the first retry without this delay.
- key: SubjectAltName
  title: Subject alt name
  type: <dictionary>
  presence: optional
  content: The subject's alternative name for the certificate.
  subkeys:
  - key: rfc822Name
    title: RFC 822 name
    type: <string>
    presence: optional
    content: The RFC 822 email address.
  - key: dNSName
    title: DNS name
    type: <string>
    presence: optional
    content: The DNS name.
  - key: uniformResourceIdentifier
    title: URI
    type: <string>
    presence: optional
    content: The uniform resource identifier.
  - key: ntPrincipalName
    title: NT principal name
    type: <string>
    presence: optional
    content: The NT principal name. Use an other name OID set to `1.3.6.1.4.1.311.20.2.3`.
examples:
- title: Credential example
  files:
  - file: examples/declarative/declarations/assets/credentials/scep/example1.json