mirror of
https://github.com/apple/device-management.git
synced 2026-08-13 20:10:19 +02:00
110 lines
2.9 KiB
YAML
110 lines
2.9 KiB
YAML
title: 'Certificate (PKCS #12)'
|
|
description: 'The payload that configures a PKCS #12-formatted certificate.'
|
|
payload:
|
|
payloadtype: com.apple.security.pkcs12
|
|
supportedOS:
|
|
iOS:
|
|
introduced: '4.0'
|
|
multiple: true
|
|
supervised: false
|
|
allowmanualinstall: true
|
|
sharedipad:
|
|
mode: allowed
|
|
devicechannel: true
|
|
userchannel: false
|
|
userenrollment:
|
|
mode: allowed
|
|
macOS:
|
|
introduced: '10.7'
|
|
multiple: true
|
|
devicechannel: true
|
|
userchannel: true
|
|
supervised: false
|
|
requiresdep: false
|
|
userapprovedmdm: false
|
|
allowmanualinstall: true
|
|
userenrollment:
|
|
mode: allowed
|
|
tvOS:
|
|
introduced: '9.0'
|
|
multiple: true
|
|
supervised: false
|
|
allowmanualinstall: true
|
|
visionOS:
|
|
introduced: '1.0'
|
|
multiple: true
|
|
supervised: false
|
|
allowmanualinstall: true
|
|
userenrollment:
|
|
mode: allowed
|
|
watchOS:
|
|
introduced: '3.0'
|
|
multiple: true
|
|
allowmanualinstall: true
|
|
content: Password-protected identity certificate. Only one certificate may be included.
|
|
payloadkeys:
|
|
- key: PayloadCertificateFileName
|
|
title: Payload certificate filename
|
|
type: <string>
|
|
presence: optional
|
|
content: The file name of the enclosed certificate.
|
|
- key: PayloadContent
|
|
title: Payload certificate data
|
|
type: <data>
|
|
presence: required
|
|
content: The binary representation of the payload, encoded in Base64.
|
|
- key: Password
|
|
title: Password
|
|
type: <string>
|
|
presence: optional
|
|
content: The password to the identity.
|
|
- key: AllowAllAppsAccess
|
|
title: Allow all apps access
|
|
supportedOS:
|
|
iOS:
|
|
introduced: n/a
|
|
macOS:
|
|
introduced: '10.10'
|
|
tvOS:
|
|
introduced: n/a
|
|
visionOS:
|
|
introduced: n/a
|
|
watchOS:
|
|
introduced: n/a
|
|
type: <boolean>
|
|
presence: optional
|
|
default: false
|
|
content: If `true`, the system allows apps access to the private key.
|
|
- key: KeyIsExtractable
|
|
supportedOS:
|
|
iOS:
|
|
introduced: n/a
|
|
macOS:
|
|
introduced: '10.15'
|
|
tvOS:
|
|
introduced: n/a
|
|
visionOS:
|
|
introduced: n/a
|
|
watchOS:
|
|
introduced: n/a
|
|
type: <boolean>
|
|
presence: optional
|
|
default: true
|
|
content: If `false`, the system doesn't tag the private key data as extractable
|
|
in the keychain.
|
|
notes:
|
|
- title: ''
|
|
content: |-
|
|
> Warning:
|
|
> The system obfuscates the profile but doesn't encrypt it, so it's possible to intercept the profile and extract the password and identity.
|
|
|
|
It's recommended to omit the password in the profile, or do one of the following instead:
|
|
|
|
- Securely deliver the profile to authorized users only, such as through MDM.
|
|
- Encrypt the profile so that only authorized devices can decrypt it.
|
|
- Use `SCEP` or `ACMECertificate` to provision the identity.
|
|
examples:
|
|
- title: Example profile
|
|
files:
|
|
- file: examples/mdm/profiles/com.apple.security.pkcs12/example1.plist
|