In inbound communication mode, when a device needs a certificate, Jamf Pro contacts the Jamf AD CS Connector, which passes on a certificate request to AD CS. AD CS returns newly generated certificates to Jamf Pro. This inbound connectivity typically requires you to open a firewall port and configure a bridge through your DMZ to allow the connection from Jamf Cloud into your network.
The Jamf AD CS Connector receives client certificate requests through Jamf Pro and runs using Microsoft's IIS web server. After a request is received from Jamf Pro, the connector converts the web request to Microsoft's native DCOM protocol, passes it to your AD CS server, and then returns the AD CS certificate request number. Jamf Pro then sends the request number back to AD CS via the connector to check if the completed certificate has been generated. After the certificate is ready, it is returned to Jamf Pro to be re-packed for distribution to a managed device. Devices never connect directly to the connector, so firewall rules can be used to restrict access. Only Jamf Pro will have the client certificate needed to authenticate to the service.
The process is similar to the one used by Microsoft's NDES (SCEP) Server role in that both services create secure web front-ends to AD CS. The main differences are that the connector requires a client certificate to authenticate connections rather than a challenge password. In addition, the connector supports the use of multiple templates, whereas an NDES server uses a single AD CS certificate template.
Jamf Pro uses the Jamf AD CS Connector to communicate with AD CS to obtain certificates. All communication is securely handled using mTLS authentication.
The following diagrams illustrate some common implementations of the Jamf AD CS Connector in inbound communication mode:
- Jamf Cloud with Jamf AD CS Connector in the DMZ
-
The following diagram illustrates how communication flows between Jamf Pro and AD CS if the Jamf AD CS Connector is hosted in the DMZ. Jamf Pro authenticates to the Jamf AD CS Connector server with a client certificate, and then the Jamf AD CS Connector contacts the Microsoft CA over DCOM to request the certificate.
- Jamf Cloud with a DMZ reverse proxy layer
-
The following diagram illustrates how communication flows between Jamf Pro and AD CS if you are using a reverse proxy or load balancer with the Jamf AD CS Connector. A reverse proxy may be used in the DMZ to reduce the number of open ports required from the DMZ to the internal network, or when a network environment does not allow DMZ-based hosts to be bound to AD.
- On-premise Jamf Pro server in the DMZ
-
The following diagram illustrates how communication flows between Jamf Pro and AD CS using the Jamf AD CS Connector if the Jamf Pro server is hosted in the DMZ.
Note:-
Devices on the internal network must be able to communicate with Jamf Pro in order to receive a certificate.
-
In a clustered environment, each node must be able to communicate with the connector.
-