The payload that configures Active Directory Certificate settings.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Certificate Server CertServer The fully qualified host name of the CA. | string | required | — | ✓Yes | macOS (10.7+) |
Certificate Template CertTemplate The certificate template for your environment. The default user certificate value is \`User\`. The default computer certificate value is \`Machine\`. | string | required | — | ✓Yes | macOS (10.7+) |
Description Description A user-friendly description of the certification identity. | string | optional | — | ✓Yes | macOS (10.7+) |
Certificate Renewal Time Interval CertificateRenewalTimeInterval The number of days in advance of certificate expiration that the notification center notifies the user. | integer | optional | — | ✓Yes | macOS (10.7+) |
Certificate Authority CertificateAuthority The name of the certificate authority (CA), which is determined from the common name (CN) of the Active Directory entry. Available in macOS 10.8 and later. Valid values:
- CN=<your CA Name>
- CN=`Certification Authorities`
- CN=`Public Key Services`
- CN=`Services`
- CN=`Configuration`
- CN=<your base Domain Name> | string | optional | — | ✓Yes | macOS (10.8+) |
Certificate Acquisition Mechanism CertificateAcquisitionMechanism This value is most commonly `RPC`; if using web enrollment, use `HTTP`. Available in macOS 10.8 and later. | string | optional | — | ✓Yes | macOS (10.8+) |
Allow All Apps Access AllowAllAppsAccess If `true`, gives apps access to the private key. Available in macOS 10.10 and later. | boolean | optional | false | ✓Yes | macOS (10.10+) |
Prompt for Credentials PromptForCredentials If `true`, the system prompts the user for credentials when is installs the profile. This key applies only to user certificates with the Manual Download profile delivery method. Omit this key for computer certificates. Available in macOS 10.8 and later. | boolean | optional | false | ✓Yes | macOS (10.8+) |
Key Is Extractable KeyIsExtractable If `true`, the system allows exporting the private key. Available in macOS 10.10 and later. | boolean | optional | false | ✓Yes | macOS (10.10+) |
Key Size Keysize The RSA key size for the certificate signing request (CSR). Available in macOS 10.11 and later. | integer | optional | 2048 | ✓Yes | macOS (10.11+) |
Enable Auto Renewal EnableAutoRenewal If `true`, the certificate obtained with this payload attempts auto-renewal. Auto-renewal can only be used with device Active Directory certificate payloads. Available in macOS 10.13.4 and later. | boolean | optional | false | ✓Yes | macOS (10.13.4+) |
