The payload that configures Automated Certificate Management Environment (ACME) settings.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
ACME directory URL DirectoryURL The directory URL of the ACME server. The URL must use the https scheme. | string | required | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
Client identifier ClientIdentifier A unique string identifying a specific device. The server may use this as an anti-replay code to prevent issuing multiple certificates. This identifier also indicates to the ACME server that the device has access to a valid client identifier issued by the enterprise infrastructure. This can help the ACME server determine whether to trust the device. Though this is a relatively weak indication because of the risk that an attacker can intercept the client identifier. | string | required | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
Key Size KeySize The valid values for `KeySize` depend on the values of `KeyType` and `HardwareBound`. See those keys for specific requirements. | integer | required | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
Key Type KeyType The type of key pair to generate. Allowed values:
- `RSA`: Specifies an RSA key pair. RSA key pairs need to have a `KeySize` that's a multiple of 8 in the range of 1024 through 4096 (inclusive), and `HardwareBound` needs to be `false`.
- `ECSECPrimeRandom`: Specifies a key pair on the P-192, P-256, P-384, or P-521 curves as defined in FIPS Pub 186-4. `KeySize` defines the particular curve, which needs to be `192`, `256`, `384`, or `521`. Hardware bound keys only support values of `256` and `384`.
> Note:
> The key size is `521`, not `512`, even though the other key sizes are multiples of 64. | string | required | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
Hardware Bound HardwareBound If `false`, the private key isn't bound to the device.
If `true`, the private key is bound to the device. The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key. This prevents the system from exporting the private key.
If `true`, `KeyType` must be `ECSECPrimeRandom` and `KeySize` must be 256 or 384.
Setting this key to `true` is supported as of macOS 14 on Apple Silicon and Intel devices that have a T2 chip. Older macOS versions or other Mac devices require this key but it must have a value of `false`. | boolean | required | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
Subject Subject The device requests this subject for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues.
The representation of a X.500 name represented as an array of OID and value. For example, `/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar` corresponds to:
`[ [ ["C", "US"] ], [ ["O", "Apple Inc."] ], ..., [ [ "1.2.5.3", "bar" ] ] ]`
Dotted numbers can represent OIDs , with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN). 1 subkey | array | required | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
└─ Array Inside ACME Subject Array ACMESubjectArrayInnerArray 1 subkey | array | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) | |
└─ └─ Subject Array Pair ACMESubjectArrayPair 1 subkey | array | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) | |
└─ └─ └─ ACME Subject Array Pair Item ACMESubjectArrayPairItem | string | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) | |
Subject Alt Name SubjectAltName The Subject Alt Name that the device requests for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues. 4 subkeys | dictionary | optional | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
└─ RFC 822 Name rfc822Name The RFC 822 (email address) string. | string | optional | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
└─ DNS Name dNSName The DNS name. | string | optional | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
└─ URI uniformResourceIdentifier The Uniform Resource Identifier. | string | optional | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
└─ NT Principal Name ntPrincipalName The NT principal name. Use an other name OID set to `1.3.6.1.4.1.311.20.2.3`. | string | optional | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
Key Usage UsageFlags This value is a bit field.
- Bit `0x01` indicates digital signature.
- Bit `0x04` indicates encryption.
The device requests this key for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues. | integer | optional | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
Extended Key Usage ExtendedKeyUsage The value is an array of strings. Each string is an OID in dotted notation. For instance, `["1.3.6.1.5.5.7.3.2", "1.3.6.1.5.5.7.3.4"]` indicates client authentication and email protection.
The device requests this field for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues. 1 subkey | array | optional | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
└─ OID OID | string | optional | — | ✓Yes | iOS (16.0+)macOS (13.1+)tvOS (16.0+)visionOS (1.0+)watchOS (9.0+) |
Attest Attest If `true`, the device provides attestations that describe the device and the generated key to the ACME server. The server can use the attestations as strong evidence that the key is bound to the device, and that the device has properties listed in the attestation. The server can use that as part of a trust score to decide whether to issue the requested certificate.
When `Attest` is `true`, `HardwareBound` also needs to be `true`.
Setting this key to `true` is supported as of macOS 14. Older macOS versions require this key but it must have a value of `false`. See below for hardware requirements. | boolean | optional | false | ✓Yes | watchOS (10.0+) |
KeyIsExtractable KeyIsExtractable If `true`, the private key of the identity obtained through Automated Certificate Management Environment (ACME) needs to be tagged as "non-extractable" in the keychain. | boolean | optional | true | ✗No | |
Allow All Apps Access AllowAllAppsAccess If `true`, all apps have access to the private key. | boolean | optional | false | ✗No |
