apple_device-management/mdm/profiles/com.apple.security.scep.yaml

title: SCEP
description: The payload that configures Simple Certificate Enrollment Protocol (SCEP)
  settings.
payload:
  payloadtype: com.apple.security.scep
  supportedOS:
    iOS:
      introduced: '4.0'
      multiple: true
      supervised: false
      allowmanualinstall: true
      sharedipad:
        mode: allowed
        devicechannel: true
        userchannel: false
      userenrollment:
        mode: allowed
    macOS:
      introduced: '10.7'
      multiple: true
      devicechannel: true
      userchannel: true
      supervised: false
      requiresdep: false
      userapprovedmdm: false
      allowmanualinstall: true
      userenrollment:
        mode: allowed
    tvOS:
      introduced: '9.0'
      multiple: true
      supervised: false
      allowmanualinstall: true
    visionOS:
      introduced: '1.0'
      multiple: true
      supervised: false
      allowmanualinstall: true
      userenrollment:
        mode: allowed
    watchOS:
      introduced: '3.0'
      multiple: true
      supervised: false
      allowmanualinstall: true
payloadkeys:
- key: PayloadContent
  title: Payload content
  type: <dictionary>
  presence: required
  content: A dictionary containing the SCEP information.
  subkeys:
  - key: URL
    title: URL
    supportedOS:
      macOS:
        introduced: '10.7'
    type: <string>
    presence: required
    content: The SCEP URL. See Over-the-Air Profile Delivery and Configuration for
      more information about SCEP.
  - key: Name
    title: Name
    type: <string>
    presence: optional
    content: A string that's understood by the SCEP server; for example, a domain
      name like example.org. If a certificate authority has multiple CA certificates,
      use this field to distinguish which is required.
  - key: Subject
    title: Subject
    type: <array>
    presence: optional
    content: |-
      The representation of an X.500 name as an array of OID and value.

      For example, `/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar` translates to `[ [ ["C", "US"] ], [ ["O", "Apple Inc."] ], …, [ [ "1.2.5.3", "bar" ] ] ]`.

      You can represent OIDs as dotted numbers, with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).
    subkeys:
    - key: SCEPSubjectArrayInnerArray
      title: Array inside SCEP subject array
      type: <array>
      subkeys:
      - key: SCEPSubjectArrayPair
        title: Subject array pair
        type: <array>
        subkeys:
        - key: SCEPSubjectArrayPairItem
          title: SCEP subject array pair item
          type: <string>
          repetition:
            min: 2
            max: 2
  - key: Challenge
    title: Challenge
    type: <string>
    presence: optional
    content: A preshared secret.
  - key: Keysize
    title: Key size
    type: <integer>
    presence: optional
    rangelist:
    - 1024
    - 2048
    - 4096
    default: 1024
    content: The key size, in bits.
  - key: Key Type
    title: Key type
    type: <string>
    presence: optional
    default: RSA
    content: Always `RSA`.
  - key: Key Usage
    title: Key usage
    supportedOS:
      macOS:
        introduced: '10.11'
    type: <integer>
    presence: optional
    default: 0
    content: |-
      A bitmask indicating the use of the key. Possible values:

      - `1`: Signing
      - `4`: Encryption

      Some certificate authorities, such as Windows CA, support only encryption or signing, but not both at the same time.
  - key: CAFingerprint
    title: Fingerprint
    type: <data>
    presence: optional
    content: The fingerprint of the Certificate Authority certificate.
  - key: Retries
    title: Retries
    supportedOS:
      macOS:
        introduced: '10.10'
    type: <integer>
    presence: optional
    default: 3
    content: The number of times the device should retry if the server sends a PENDING
      response.
  - key: RetryDelay
    title: Retry delay
    supportedOS:
      macOS:
        introduced: '10.10'
    type: <integer>
    presence: optional
    default: 10
    content: The number of seconds to wait between subsequent retries. The device
      attempts the first retry without this delay.
  - key: SubjectAltName
    title: Subject alt name
    type: <dictionary>
    presence: optional
    content: The SCEP payload can specify an optional `SubjectAltName` dictionary
      that provides values required by the CA for issuing a certificate. You can specify
      a single string or an array of strings for each key. The values you specify
      depend on the CA you're using, but might include DNS name, URL, or email values.
      For an example, see Sample Configuration Profile or Over-the-Air Profile Delivery
      and Configuration.
    subkeys:
    - key: rfc822Name
      title: RFC 822 name
      type: <string>
      presence: optional
      content: The RFC 822 (email address) string.
    - key: dNSName
      title: DNS name
      type: <string>
      presence: optional
      content: The DNS name.
    - key: uniformResourceIdentifier
      title: URI
      type: <string>
      presence: optional
      content: The Uniform Resource Identifier.
    - key: ntPrincipalName
      title: NT principal name
      type: <string>
      presence: optional
      content: The NT principal name. Use an other name OID set to `1.3.6.1.4.1.311.20.2.3`.
  - key: KeyIsExtractable
    supportedOS:
      macOS:
        introduced: 10.13.4
    type: <boolean>
    presence: optional
    default: true
    content: If `false`, the system disables exporting the private key from the keychain.
  - key: AllowAllAppsAccess
    title: Allow all apps access
    supportedOS:
      macOS:
        introduced: '10.10'
    type: <boolean>
    presence: optional
    default: false
    content: If `true`, all apps have access to the private key.
notes:
- title: ''
  content: A SCEP payload automates the request of a client certificate from a SCEP
    server, as described in [Over-the-Air Profile Delivery and Configuration](https://developer.apple.com/library/archive/documentation/NetworkingInternet/Conceptual/iPhoneOTAConfiguration/Introduction/Introduction.html).
examples:
- title: Profile example
  files:
  - file: examples/mdm/profiles/com.apple.security.scep/example1.plist