Step 2: Configuring AD CS as a Certificate Authority for Outbound Communication Mode

Technical Paper: Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro
Solution
Application
Content Type
Technical Documentation
Utilities & Services
Jamf AD CS Connector
ft:locale
en-US

You can configure the PKI certificates settings in Jamf Pro to use AD CS as a certificate authority.

Adding AD CS as a certificate authority in Jamf Pro requires you to configure the AD CS integration settings and the Jamf AD CS Connector settings. This involves defining the location of the connector and AD CS servers and adding client and server certificates to permit authentication between Jamf Pro and the connector.

After you add AD CS as a certificate authority in Jamf Pro, you can use the PKI certificates settings in Jamf Pro to view and edit information about the CA. In addition, you can use the PKI certificates settings to view information about the active, expired, or inactive AD CS certificates that have been distributed to devices via configuration profiles.

  1. In Jamf Pro, click Settings in the sidebar.
  2. In the Global section, click PKI certificates .
  3. Click Configure New Certificate Authority.
  4. Select Active Directory Certificate Services (AD CS) and click Next.
  5. In the AD CS Server Integration area, do the following:
    1. Enter a display name for the integration in the Display Name for Integration field.
    2. Enter the name of the certificate authority in the CA Name from AD CS Server field.

      The CA name is the common name of the issuing certification authority.

    3. Enter the fully qualified domain name of the server that hosts AD CS in the Fully Qualified Domain Name field.
  6. In the Jamf AD CS Connector area, select or deselect the Automatic certificate revocation checkbox as needed.
    Note:

    If you enable automatic certificate revocation, you must also grant the "Issue and Manage Certificates" permission in the CA Properties Security settings in AD CS. For more information, see Configuring a Template and Permissions on the Active Directory Certificate Services (AD CS) Server.

    When automatic certificate revocation is enabled, certificates issued by AD CS are queued for revocation immediately after the Wipe Computer, Wipe Device, or Unmanage Device action is taken. When computers or mobile devices fall out of the scope of the configuration profile that issues the certificate, the certificate will be queued for revocation after the computers or mobile devices acknowledge the remove profile command.

    Note:

    If automatic certificate revocation is enabled and you disable it, any certificates that have been marked for revocation will continue to be revoked after revocation is disabled.

  7. Click Outbound as the connector mode.
  8. Enter the API Client ID that you created earlier in the Client ID field.
  9. Click Save .
  10. Take note of the AD CS integration ID, which you will need for the -adcsId parameter when installing the Jamf AD CS Connector.

    The -adcsId is the number at the end of the URL displayed in your browser's address bar, typically "3" for a new installation.

AD CS is listed as a certificate authority on the Certificate Authorities tab.

When integration with AD CS is complete, you can use Jamf Pro to distribute certificates to devices using configuration profiles with AD CS as the CA. For more information, see Distributing AD CS Certificates Using the Certificate Payload.

In addition, if your environment uses in-house apps that have been developed with the Jamf Certificate SDK, you can use Jamf Pro to distribute them. For more information, see Distributing an In-House App Developed with the Jamf Certificate SDK.