This guide is designed for IT administrators who want to use Active Directory Certificate Services (AD CS) as a PKI provider, or certificate authority, in Jamf Pro to distribute AD CS-sourced certificates to computers or mobile devices.
- Jamf AD CS Connector (the method covered in this guide) —A web application that manages communication between Jamf Pro and AD CS. The Jamf AD CS Connector can be configured in Jamf Pro using either the SCEP or Certificate payload.
- Simple Certificate Enrollment Protocol (SCEP) using Microsoft Network Device Enrollment Service (NDES) —This method can also support Jamf Pro's SCEP proxy feature. For more information, see the Enabling Jamf Pro as SCEP Proxy for Configuration Profiles technical paper.
- Active Directory Certificate payload (macOS only) —This method requires binding a Mac to Active Directory. For more information, see Active Directory Certificate MDM payload settings for Apple devices in Apple Platform Deployment.
The following table indicates which features are supported by each deployment method:
| Feature | Jamf AD CS Connector—SCEP Payload | Jamf AD CS Connector—Certificate Payload | SCEP Using NDES | Active Directory Certificate Payload (macOS only) |
|---|---|---|---|---|
| Certificate revocation | X | X | — | — |
| Certificate renewal | X | X | X | X |
| Device-bound private key | X | — | X | — |
| Jamf Pro-proxied communication | X | X | X | — |
| Dynamic challenges | X | X | X | — |
| Open to non-domain-bound devices | X | X | X | — |
| Inbound communication | X | X | X | X |
| Outbound communication | X1 | X1 | — | — |
| Multiple certificate templates | X | X | —2 | X |
1 When using Jamf AD CS Connector 2.0.0 or later
2 Requires running multiple NDES servers. When using Jamf Pro as proxy, only one NDES server can be specified.
The remainder of this guide discusses integrating Jamf Pro with AD CS using the Jamf AD CS Connector.
- Jamf AD CS Connector Communication Modes
You can configure the Jamf AD CS Connector to run in either inbound communication mode or outbound communication mode. You should choose the mode that best meets the needs of your organization. If your Jamf Pro instance is hosted in Jamf Cloud and you do not want to open firewall ports to your AD CS infrastructure, you should use the connector's outbound mode. If you have an on-premise Jamf Pro environment and you have remote-signed certificates, you can use the connector's outbound mode. Otherwise, you should use inbound mode.
- Inbound communication mode —
In inbound communication mode, when a device needs a certificate, Jamf Pro contacts the Jamf AD CS Connector, which passes on a certificate request to AD CS. AD CS returns newly generated certificates to Jamf Pro. This inbound connectivity typically requires you to open a firewall port and configure a bridge through your DMZ to allow the connection from Jamf Cloud into your network. For more information, see Inbound Communication Mode.
- Outbound communication mode —
In outbound mode, the connector will periodically connect outbound to Jamf Pro to retrieve any outstanding certificate requests. No firewall ports or reverse proxy configuration are required. Outbound mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later. For more information, see Outbound Communication Mode.
- Inbound communication mode —
- Certificate Distribution
You distribute AD CS certificates by deploying configuration profiles from Jamf Pro to computers and mobile devices. AD CS must first be configured as a certificate authority in Jamf Pro.
You can choose either the Certificate payload or the SCEP payload within a configuration profile to distribute AD CS certificates to computers or mobile devices. Both payloads offer key size customization, automatic certificate revocation, inbound or outbound communication, and multiple templates.
Certificate distribution via SCEP provides enhanced security as each device generates its own unique key pair, which never leaves the device, reducing the risk of key compromise.
For more information, see DigiCert PKI Platform 8 (Legacy).
- In-house Apps
You can distribute in-house apps developed with the Jamf Certificate SDK to establish identities for supporting certificate-based authentication. These allow you to perform single sign-on (SSO) or other actions specific to your environment. Jamf Pro allows you to apply a managed app configuration to an app during distribution to enable the app to request the necessary certificates.
For more information, see Distributing an In-House App Developed with the Jamf Certificate SDK.