Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Onboard CA and SCEP Integration for JAMF-Managed Devices

Onboard CA Configuration in HPE Mist Networking Access Assurance provides a cloud-native SCEP service that integrates directly with JAMF for automated client certificate distribution. This eliminates the need for an external PKI and simplifies secure Wi-Fi onboarding with EAP-TLS authentication.

HPE Mist Networking Access Assurance provides Onboard Certificate Authority (CA) configuration, which delivers a fully managed Simple Certificate Enrollment Protocol (SCEP) infrastructure. When the Onboard CA is enabled, Access Assurance automatically provisions all the elements required for seamless JAMF integration—the Jamf SCEP URL, Jamf Access Token, and Jamf Webhook URL. With only these values, you can integrate JAMF with HPE Mist Networking Access Assurance without deploying or maintaining any external PKI or on-premises SCEP service. The Onboard CA certificate provided by Access Assurance is then used to configure a SCEP profile within JAMF, enabling secure client certificate issuance to enrolled devices.

By leveraging the Access Assurance SCEP infrastructure, you can automate the distribution of client certificates to JAMF-managed endpoints, binding them to Wi-Fi profiles for EAP-TLS authentication. This feature ensures that every device connecting to the network is authenticated through strong, certificate-based trust while fully managed from the HPE Mist Networking Access Assurance cloud.

Note: When a device is marked as inactive or deleted in JAMF, you must revoke the client certificate manually through the management portal.

To enable JAMF to leverage HPE Mist Networking Access Assurance as its SCEP infrastructure for client certificate distribution, follow these steps:

Enable Onboard CA Configuration

To enable the Onboard CA configuration:

  1. From the left menu of the management portal, select Organization > Access > Certificates.

    The Certificate Authorities page appears.

  2. Click the settings icon on the upper-right corner of the page and select Onboard CA Configuration.

    Certificate Authorities section with options to add, view, or import certificates, and a table stating no certificates available.

  3. Select Active and click OK.

    Onboard CA Configuration pop-up set to Active and no certificates listed.

    The onboard Certificate Authority service is enabled, and the respective SCEP endpoints are generated for each MDM.

    When the Onboard CA configuration is activated, you’ll see the following tabs displayed:

    • External—Displays the details of the external CAs.

    • Internal— Displays the details of client certificates issued by the built-in CA through the NAC portal or MDM.

  4. Click the settings icon on the upper-right corner of the page again and select MDM Integration Information.

    Certificate Authorities section showing no certificates listed, with options to add or import certificates and navigate tabs for External and Internal authorities.

  5. Copy the JAMF Access Token, JAMF Webhook URL, and JAMF SCEP URL. You'll need to use this URL in the JAMF SCEP profile.

    Certificate Authorities, with MDM Integration Information pop-up displaying Jamf integration fields for access token, webhook URL, and SCEP URL.

Download the Onboard CA and Org CA Certificates

The HPE Mist Networking Org CA certificate is required to configure JAMF managed clients to trust the RADIUS server certificate of the HPE Mist Networking Access Assurance service. The Onboard CA certificate is needed to configure the SCEP profile on JAMF.

  1. Click the settings icon on the upper-right corner of the Certificates page and select Download Onboard CA Certificate. This certificate will be used as the SCEP certificate in Jamf.

    Certificate Authorities section with Internal tab selected, no certificates listed, and actions for adding or managing certificates.

  2. Navigate to Organization>Access>Certificates. Click View Mist Certificate and click Download. This certificate will be used as the Root certificate in Jamf.

    Certificate management interface showing a View Certificate window with PEM-format certificate data, properties like Common Name, validity dates, issuer, and a download button. Navigation menu on the left includes options like Monitor and Clients. Branding suggests HPE Mist Networking system.

    Note: If you are using a Custom RADIUS Server certificate, the HPE Mist Networking Org CA certificate is not required. You'll need to have the Root CA certificate of the Custom RADIUS Server certificate issuer.

Configure a JAMF Webhook

You'll need to configure a JAMF webhook to receive dynamically generated SCEP challenges for each certificate enrollment request.

Note:

The screenshots from third-party applications are correct at the time of publishing. We have no way to know when or if the screenshots will be accurate at any future time. Please refer to the third-party website for guidance about changes to these screens or the workflows involved.

  1. In the JAMF Pro dashboard, navigate to Settings>Webhooks, and click New.

    Settings interface with dark theme showing navigation sidebar with categories like Dashboard, Devices, Users, and Settings. Main area displays Webhooks search result under Global category, with description Create outbound webhooks for custom workflows on-demand. Tabs for filtering settings by categories are at the top, and Display icons checkbox is visible on the right.

    User interface for managing webhooks with a list showing columns for Name, Event, and URL, a sidebar with navigation options, and a highlighted New button to add a webhook.

  2. In the New Webhook page, enter the following information and click Save:

    • Display Name—Name for the webhook

    • Webhook URL.—Jamf Webhook URL that you copied earlier.

    • Authentication Type—Header Authentication

    • Header metadata—{"Authorization":"Bearer <Jamf Access Token"}

    • Connection Timeout—5 seconds

    • Read Timeout—2 seconds

    • Content Type—JSON

    • Webhook Event—SCEP Challenge

    Configuration screen for setting up a webhook with display name Mist-SCEP-Notifications, enabled checkbox, URL, header authentication using a bearer token, 5-second connection timeout, 2-second read timeout, JSON content type, and SCEPChallenge event trigger. Save and Cancel buttons visible.

Create a Configuration Profile

We've used the macOS device as an example, but the steps are the same for iOS devices.

Note:

The screenshots from third-party applications are correct at the time of publishing. We have no way to know when or if the screenshots will be accurate at any future time. Please refer to the third-party website for guidance about changes to these screens or the workflows involved.

  1. In the JAMF Pro dashboard, navigate to Computers >Configuration Profiles , and click New.

    Configuration Profiles interface under Computers section; sidebar menu includes inventory, search, and management options; main panel displays empty table with columns for profile status; action buttons for creating or uploading profiles.

  2. Ensure that the Level is set to Computer Level.

    New macOS Configuration Profile interface showing fields for display name, description, category, level, distribution method, and save or cancel buttons. Configuration profiles section is selected in the navigation panel.

  3. Select the Certificate tab, enter the following information and click Save:

    • Certificate Name

    • Click Upload Certificate and upload the HPE Mist Org CA certificate that you downloaded earlier.

      If you are using a Custom RADIUS Server certificate, the Mist Org CA certificate is not required. You'll need to have the Root CA certificate of the Custom RADIUS Server certificate issuer.

    Creating a macOS configuration profile with certificate upload, password entry, and app access options.

  4. Select the SCEP tab, enter the following information and click Save:

    • URL—Jamf SCEP URL
    • Name—MIST-SCEP-CA
    • Redistribute Profile—number of days before the certificate expiration date to push the profile again
    • Subject—CN=$COMPUTERNAME
    • SAN Type—add the DNS Name with value $UDID
      Note:

      Including the Device ID in the SAN:DNS field is mandatory because NAC uses this value for device identification and compliance checks.

    • Challenge Type—Dynamic
    • Retries—3
    • Retry Delay—5
    • Certificate Expiration Notification Threshold—number of days before the certificate expiration date to display the certificate expiration notification
    • Key Size—2048
    • Select the Use as digital signature checkbox
    • Select the Use for key encipherment checkbox
    • Do not select the Allow Export from keychain checkbox
    • Certificate—Upload the HPE Mist Onboard CA certificate that you downloaded in the earlier step.

    Configuration interface for creating a macOS SCEP profile with fields for certificate authority type, SCEP server URL, instance name, redistribute profile days, X.500 subject name, subject alternative names, challenge type, retries, retry delay, expiration notification threshold, key size, certificate options, and upload certificate. Left sidebar lists other configuration categories with statuses. Save and Cancel buttons at the bottom.

  5. Select the Network tab, click Configure to enable the Wi-Fi profile. Enter the following information and click Save:

    • SSID—Your SSID name
    • Security Type—WPA2 or WPA3 Enterprise depending on your WLAN configuration
    • Accepted EAP Types—TLS
    • Identity Certificate—SCEP (MIST-SCEP-CA)

    Configuration screen for creating a macOS network profile with Wi-Fi set as the interface, SSID secure-net, WPA3 Enterprise encryption, EAP type TLS, and identity certificate SCEP MSFT-SCEP-CA selected.

    Ensure to select the Trust tab and check the HPE Mist Org CA certificate for Server Certificate validation:

    Network Security Settings screen for 802.1X authentication, showing fields for username, TLS version, identity and trusted certificates, server certificate names, trust exceptions, and QoS marking, with Save and Cancel buttons.

  6. Select the Scope tab and assign the profile to your devices.

    When the profile is pushed to the client, you'll see a new certificate issued to your macOS device under Keychain Access >My Certificates.

    Go to the HPE Mist management portal and confirm that the client certificate is issued under Certificates>Internal.

    Internal Certificate details including client name iPadDFLZ 2, serial number, device ID, validity dates, and certificate provider Jamf. Sidebar options include Monitor, Marvis, Clients, and Access Points.

Configure Custom Client Certificate Validity for Jamf

By default, client certificates issued through Jamf using HPE Mist SCEP are valid for 1 year. To configure a custom certificate validity period, include a Uniform Resource Identifier entry in the Subject Alternative Name (SAN) field of the certificate profile. You must provide the following information:

  • SAN Type—add the DNS Name with value $UDID

  • Uniform Resource Identifier—enter the following:

    tag:juniper.net,CertValidity:<validity-in-days>

    For example: tag:juniper.net,CertValidity:730. In this example, the client certificate will be valid for 2 years from the certificate issuance date instead of the default 1-year validity period.

    Configuration interface for defining certificate subject and optional SANs. Highlighted URI SAN entry shows tag:juniper.net,CertValidity:730.