Home Knowledge Base SecureW2 Documentation Integrating Iru with EAP-TLS for Certificate Auto-Enrollment

Integrating Iru with EAP-TLS for Certificate Auto-Enrollment

Introduction

MDMs can use the Simple Certificate Enrollment Protocol (SCEP) to automate the certificate life cycle for Managed devices. This saves administrators time compared to manually enrolling managed devices for certificates.

Iru is an MDM platform that supports Apple devices, including macOS, iOS, iPadOS, and tvOS. It also supports security and productive global work with the help of an advanced automation system. When it comes to certificate enrollment with SCEP, Iru provides the SCEP URL and key, which the device can use to request a certificate from the PKI.

In this document, we will show you how to configure the SecureW2 SCEP Gateway API to auto-enroll Iru-managed devices for certificates and configure the user device for Certificate-Based Wi-Fi authentication.

Prerequisites

To set up Iru for device enrollment using SCEP, you need:

  1. Active SecureW2 Cloud Connector license
  2. Active SecureW2 Managed Device Gateway license
  3. Active Iru license
  4. Enterprise-grade Access Points (They Support WPA2-Enterprise)
  5. iOS or macOS Devices Actively Managed in Iru

Configure SecureW2

This section describes the following procedures carried out in the JoinNow Management Portal:

  1. Creating a SecureW2 Intermediate CA
  2. Creating an Iru Certificate Template
  3. Creating a Device Management Platform
  4. Creating the policies (Role, Enrollment, and Network policies)

Creating an Intermediate CA for Iru Integration

As a best practice, SecureW2 recommends creating a dedicated intermediate CA for each SCEP Gateway API. Using a separate CA for each gateway simplifies certificate management and allows you to create enrollment and network policies based on the issuing CA.

To create a new intermediate CA, perform the following steps:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Dynamic PKI > Certificate Authorities.
  3. Click Add Certificate Authority.
  4. In the Basic section, from the Generate CA For drop-down list, select Device and User Authentication to authenticate devices and users.
  5. From the Type drop-down list, select Intermediate CA.
  6. From the Certificate Authority drop-down list, select the default Root CA that comes with your organization.
  7. In the Common Name field, enter a common name for the CA certificate. SecureW2 recommends a name that includes “SCEP.”
  8. From the Key Size drop-down list, select 2048 for the CA certificate key pair.
  9. From the Signature Algorithm drop-down list, select the signature algorithm for the certificate signing request. The option available is SHA-256.
  10. In the Validity Period (in years) field, enter the validity period of the CA certificate.
  11. In the Notifications section:
    1. From the Expiry Notification Frequency (in days) drop-down list, select the frequency interval for which a certificate expiration notification should be sent to users.
    2. Select the Notify user on successful Enrollment check box to notify users after a successful enrollment.
  12. In the Revocation section:
    1. In the Revoke Certificate if unused for field, select the number of days after which an unused certificate can be revoked.
      • Since last usage – Select this checkbox to revoke the certificate after a specified number of days if it remains unused.
      • Since certificate issuance – Select this checkbox to revoke the certificate after a specified number of days after it is issued.
    2. From the Reason Code drop-down list, select any one of the following reasons for which the certificate is revoked.
      • Certificate Hold
      • AA Compromise
      • Privilege Withdrawn
      • Unspecified
  13. Click Save. The new intermediate CA is generated.

Creating an Iru Certificate Template

A certificate template is a blueprint for the attributes that must be encoded on a certificate and its intended use case. 

To create a certificate template, perform the following steps:

  1. Navigate to Dynamic PKI > Certificate Authorities.
  2. Scroll down to the Certificate Templates section.
  3. Click Add Certificate Template.

  4. In the Basic section, enter the name of the certificate template in the Name field.
  5. In the Subject field, enter CN=${/device/clientId}
  6. In the Display Description field, enter a suitable description for the certificate template.
  7. In the Validity Period field, type the validity period of the certificate (based on the requirement).
  8. From the Signature Algorithm drop-down list, select the signature algorithm for the certificate signing request. The option available is SHA-256.
  9. In the SAN section:
    1. In the Other Name field, enter ${/device/identity}
    2. In the RFC822 field, enter ${/device/clientId}
    3. In the DNS field, enter ${/device/identity}
  10. In the Extended Key Usage section, from the Use Certificate For list, select Client Authentication.

  11. Click Save.

Creating a Device Management Platform

In this section, we create a Device Management Platform, which generates a .csv file containing the Enrollment URL and API Secret. These values are configured in Iru’s SCEP Profile, where the Enrollment URL serves as an endpoint that allows managed devices to connect with the SecureW2 SCEP server and enroll for certificates.

To create a device management platform, perform the following steps:

  1. Navigate to Integration Hub > Device Management Platforms.
  2. Click Add.
  3. In the Basic section, enter the name of the Device Management Platform in the Name field.
  4. In the Description field, enter a suitable description for the Device Management Platform.
  5. From the Type drop-down list, select SCEP (Multi-Vendor) Enrollment Token.
  6. From the Vendor drop-down list, select Kandji.
  7. From the Certificate Authority drop-down list, select the intermediate CA you created in the Creating an Intermediate CA for Iru Integration section.
  8. Click Save. A .csv file containing the API Secret and Enrollment URL is downloaded. In addition, the Enrollment URL is displayed on the page.NOTE: Save the file securely. This file is downloaded only once during token creation. If lost, the token and secret cannot be retrieved.

Policy Management

Policy Management determines how certificates are issued and how network access is granted. It consists of three components, configured in order:

  1. Policy Workflow – Segments users and devices into roles based on defined criteria or attributes.
  2. Enrollment Policy – Uses those roles to issue the correct certificate to users and devices, based on the mapped certificate template.
  3. Network Policy – Applies those roles to grant or deny network access.

Configuring a Policy Workflow

Policy Workflow segments users and devices based on defined criteria or attributes. It allows you to define and create roles based on attributes and groups retrieved from the Device Management Platform. These roles can then be assigned a unique Enrollment Policy for certificate issuance and used to trigger a Network Policy.

To create a policy workflow, perform the following steps:

  1. Navigate to Policy Management > Policy Workflows.
  2. Click Add Policy Workflow.
  3. In the Basic section, enter the name of the policy workflow in the Name field.
  4. In the Display Description field, enter a suitable description for the policy workflow.
  5. Click Save.
  6. The page refreshes, and the Conditions tab is displayed.
  7. Select the Conditions tab.
  8. From the Core Provider drop-down list, select the Device Management Platform you created earlier.
  9. Click Update.

Configuring an Enrollment Policy

An Enrollment Policy defines the client certificate template and the Certificate Issuer to be used for each Policy Workflow. It leverages the segmentation established in the Policy Workflow to ensure the appropriate template and issuer are applied to each workflow.

To configure an enrollment policy, perform the following steps:

  1. Navigate to Policy Management > Enrollment.
  2. Click Add Enrollment Policy.
  3. In the Basic section, enter the name of the enrollment policy in the Name field.
  4. In the Display Description field, enter a suitable description for the enrollment policy.
  5. Click Save. The page refreshes, and the Conditions and Settings tabs are displayed.
  6. Select the Conditions tab.
  7. In the Policy Workflow list, select the Policy Workflow you created earlier.
  8. From the Device Role list, select DEFAULT DEVICE ROLE POLICY 1.

  9. Select the Settings tab.
  10. From the Use Certificate Authority drop-down list, select the intermediate CA you created earlier (refer to the Creating an Intermediate CA for Iru Integration​ section).
  11. From the Use Certificate Template drop-down list, select the template you created earlier (refer to the Creating an Iru Certificate Template section).
  12. Retain the default values for the other settings.
  13. Click Update.

Configuring a Network Policy

A Network Policy defines how device connection decisions are made based on device information obtained from the Policy Workflow. It allows you to specify whether the device will be granted or denied network access, along with other RADIUS attributes that can be sent, which are most commonly VLAN assignments.

NOTE: Configure a Network Policy only if your organization uses SecureW2 CloudRADIUS as its RADIUS server.

To configure a network policy, follow these steps:

  1. Navigate to Policy Management > Network.
  2. Click Add Network Policy.
  3. In the Basic section, enter the name of the network policy in the Name field.
  4. In the Display Description field, enter a suitable description for the network policy.
  5. Click Save. The page refreshes, and the Conditions and Settings tabs are displayed.
  6. Select the Conditions tab.
  7. Select Match All or Match Any based on your requirement to set authentication criteria. In the case explained here, we are selecting Match All.

  8. Click Add rule and select the Policy Workflow you want to assign to this network policy. It is essential to select the appropriate policy workflow, as it triggers the network policy. This menu offers various rules that you can select based on your business requirements.
  9. Click Save.
  10. The Policy Workflow option appears under the Conditions tab.
  11. From the Policy Workflow Equals drop-down list, select the user role policy you created earlier (refer to the Configuring a Policy Workflow section). You can select multiple User Roles to assign to a Network Policy.
  12. Navigate to the Settings tab.
  13. From the Access drop-down list, select any one of the options to allow or deny authentication requests. The default value is Allow.
  14. Click Add Attribute.
    1. From the Dictionary drop-down list, select an option:
      1. Radius: IETF – Uses standard RADIUS attributes for VLAN assignment.
      2. Custom: Uses Vendor-Specific Attributes (VSA).
    2. Add the RADIUS attributes required for VLAN assignment. For reference, here is what is commonly required for VLAN Assignment:
      1. Tunnel-Medium-Type: IEEE-802
      2. Tunnel-Private-Group-ID: {VLAN Name}
      3. Tunnel-Type: VLAN
    3. Click Save.
  15. Click Update.

Exporting RADIUS Root CA

To allow managed devices to trust the RADIUS server during authentication, you’ll need to export the RADIUS Root CA (DigiCert Global Root G3). This certificate is later uploaded to the Certificate Trust section of the SCEP Profile configuration as the Specify Trusted Certificate, allowing devices to validate the RADIUS server’s certificate during EAP-TLS authentication.

To export the RADIUS Root CA, perform the following steps:

  1. Navigate to RADIUS > RADIUS Configuration.
  2. Click Download to save the server root CA.

Configure Iru

This section covers creating a Wi-Fi Library Item in Iru and configuring it for certificate-based (EAP-TLS) authentication, with SCEP used to automatically enroll managed devices for the required certificate from SecureW2.

Configuring the Wi-Fi Library Item

Creating a Wi-Fi Library Item

A Wi-Fi Library Item defines the network profile that Iru pushes to managed devices. This section walks through creating the item and assigning it to a blueprint.

  1. On the left navigation bar, click Library.
  2. Click + Add Library Item on the top-right.
  3. In the Search Library Item field, enter Wi-Fi and select it from the results.
  4. Click Add and configure. A new Wi-Fi Library Item will be opened for configuration.
  5. In the Add a title field, enter a name for the new Wi-Fi Library Item.

    NOTE: Use the title to differentiate this Library Item from other Wi-Fi Library Items. Use a name that identifies the item — for example, the title might include the SSID or the location where the Wi-Fi configuration is used.
  6. In Assignment Maps, click + Assign and select the blueprint you want to deploy to.

Configuring General Wi-Fi Settings

These settings define the network’s SSID and how devices connect to it.

  1. In the General section, in the Service Set Identifier (SSID) field, enter a name for your network.
  2. Select Auto join network to enable devices to automatically connect to this network when it is available.

    NOTE: If you do not select Auto Join Network, devices will have the configuration required to connect to the network; however, users must manually choose to connect.
  3. Select Hidden network if the network does not broadcast its SSID. Hidden networks are neither standards-compliant nor recommended for use.
  4. If you wish to turn off MAC address randomization, select Disable MAC address randomization.
  5. From the Authentication type drop-down list, choose WPA2-Enterprise.
  6. From the Accepted EAP Types drop-down list, select TLS.

Configuring the SCEP Profile

This section configures the SCEP profile that allows managed devices to automatically request and receive a certificate from SecureW2 during enrollment.

  1. From the Identity certificate drop-down list, select SCEP. The Configure SCEP page is displayed.
  2. On the Configure SCEP page, enter the Enrollment URL from the .csv file created in the Creating a Device Management Platform section in the URL field.
  3. In the Challenge field, enter the API Secret Key obtained from the .csv file created in the Creating a Device Management Platform section.
  4. In the Subject field, enter CN=$DEVICE_NAME
  5. Select the Subject Alternative Names (SAN) checkbox.
  6. In the Subject Alternative Names (SAN) section:
    1. From the Select SAN Type drop-down list, select RFC 822 Name. In the adjacent field, enter $SERIAL_NUMBER.
    2. Click Add.
    3. From the Select SAN Type drop-down list, select NT Principal Name. In the adjacent field, enter $EMAIL.
    4. Click Add.
    5. From the Select SAN Type drop-down list, select DNS Name. In the adjacent field, enter $DEVICE_NAME.
  7. In the Key section:
    1. From the Key size drop-down list, select 2048.
    2. From the Key usage drop-down list, select Both signing and encryption.
  8. In the Additional options section:
    1. Select the Automatic profile redistribution checkbox, then specify how many days before the certificate’s expiration Iru should reissue the SCEP profile for renewal.
    2. Select the Allow all apps to access the private key checkbox to allow all apps to access the certificate in the keychain.
    3. Select the Prevent the private key data from being extracted in the keychain checkbox. This disables the export of the private key from the keychain.
  9. Click Done.
  10. In the Certificate trust section: 
    1. Select the Specify trusted certificates checkbox and click Choose file to upload the DigiCert Global Root G3 RADIUS Root CA obtained from the Exporting RADIUS Root CA section.
  11. Select the Specify server certificate names checkbox and click + Add.
  12. In the Server certificate name field, enter radius01.securew2.com
  13. Click Save, then click Close.

Assigning Library Items to the Blueprint

Once the Root CA, Intermediate CA, and Wi-Fi Library Items are created, assign all three to the blueprint so they are pushed to your managed devices.

To assign the Library Items to the blueprint, perform the following steps:

  1. On the left navigation bar, click Blueprints and select the blueprint to which you want to assign the Library Items.
  2. Select the Assignment Map tab and click Edit assignments.
  3. In Library Items, search for the two certificate library items created in the Creating Certificate Library Item section and the Wi-Fi library item created in the Configuring the Wi-Fi Library Item section. Drag all three items onto the map to assign them to devices.
  4. Click Save.

Deployment and Certificate Issuance

After completing the steps above, the profile is pushed to the device, triggering certificate enrollment.

JoinNow Admins can check for successful certificate enrollment under Data and Monitoring > Enhanced Events. A Certificate Issued event should be displayed when device certificate enrollment is successful.

The RADIUS Events page details the device lookup attributes. To access the RADIUS Events page, log in to the JoinNow Management Portal and navigate to Data and Monitoring > RADIUS Events.

Secure EAP-TLS Authentication with Iru and SecureW2

With our SCEP API gateways configured, your organization can use Iru to automatically enroll your Iru-managed devices for certificates. It’s an elegant solution that uses our gateways to issue an SCEP URL and Key to your managed devices, allowing them to request certificates from our PKI with no end-user input.

SecureW2 PKI offers a better user experience and a PKI that can seamlessly integrate with Iru for SCEP certificate enrollment. This leads to faster and simpler certificate distribution so your administrators can focus on other tasks. For more information, click here to see our pricing details.

More Iru Explainers
Reseller or MSP? Join our Partner Program