The Challenge
A cloud-focused cybersecurity company’s internal Wi-Fi lacked security due to outdated password-based network access. This created a security gap and an optics problem.
The device fleet spanned three Mobile Device Management (MDM) platforms: Jamf for Mac, Workspace ONE for legacy Windows, and Intune for Windows. All three needed certificate enrollment configuration — each with a unique integration path.
In addition to securing Wi-Fi with certificate-based authentication, the firm also wanted to leverage the added security certificates offer for Palo Alto Global Protect VPN authentication and internal web servers. Finally, the company intended to replace its internal certificate authority with a cloud-based PKI service.
The Solution
The deployment moved through four structured implementation sessions over several months.
Session one configured SCEP-based certificate enrollment through Jamf for the Mac fleet and Intune for Windows devices migrating from Workspace ONE. Session two brought Workspace ONE into the fold for legacy Windows machines. Session three tackled WSTEP for domain-joined Windows devices authenticating against Active Directory. Finally, session four added Palo Alto Global Protect VPN certificate authentication. In total, the company enrolled around 4,000 company devices.
The team shifted from device certificates to user certificates and shortened the validity to 90 days, tightening their security posture. Meraki handles wireless, while Cisco Catalyst 9300 and Arista switches serve the wired side. Okta provides identity with Duo for two-factor authentication. All certificate enrollment flows authenticate against a cloud-native RADIUS server with real-time identity lookups.
The Results
- 4,000 devices enrolled across three MDM platforms (Jamf, Workspace ONE, Intune) in just a few months
- 90-day user certificates replaced device certificates for a stronger security posture
- Internal CA slated for decommission: cloud-based PKI replacing on-premises certificate infrastructure
Once the internal CA is decommissioned, the JoinNow platform will serve as the sole certificate authority for the company’s entire corporate infrastructure. The firm is working toward a model where every network touchpoint — Wi-Fi, VPN, wired, and web applications — authenticates through a single, cloud-managed certificate lifecycle.