Home Knowledge Base SecureW2 Documentation Fleet MDM Enrollment using ACME

Fleet MDM Enrollment using ACME

Introduction

This integration connects Fleet MDM with SecureW2 managed PKI to automate certificate-based security across managed devices. SecureW2 acts as the certificate authority—issuing, renewing, and revoking digital certificates without manual intervention.

When a device is enrolled in Fleet, it can automatically receive a SecureW2-issued certificate, enabling passwordless authentication to Wi-Fi, VPN, and other network resources. This eliminates reliance on shared credentials, strengthens security through strong certificate-based authentication, and gives IT teams a single, automated workflow for provisioning and lifecycle management of device identities.The following guide provides the steps required to configure Fleet MDM with SecureW2 PKI.

Prerequisites

The following are the prerequisites for setting up ACME enrollment with Fleet using SecureW2 CloudRADIUS:

  1. An active subscription with SecureW2 JoinNow PKI.
  2. An active subscription with Fleet MDM.

Configuring JoinNow Management Portal

This section describes the following procedures carried out in the JoinNow Management Portal:

  1. Creating an Intermediate CA in JoinNow
  2. Creating a Certificate Template 
  3. Creating a Device Management Platform for Fleet MDM
  4. Creating the policies (Policy Workflow, Enrollment, and Network policies)

Creating an Intermediate CA

To create a new intermediate CA:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Dynamic PKI > Certificate Authorities. 
  3. Click Add Certificate Authority.
  4. In the Basic section, from the Generate CA For drop-down list, select the Device and User Authentication option to authenticate devices and users.
  5. From the Type drop-down list, select Intermediate CA.
  6. From the Certificate Authority drop-down list, select the default Root CA that comes with your organization.
  7. In the Common Name field, enter a common name for the CA certificate. SecureW2 recommends a name that includes “SCEP.”
  8. From the Key Size drop-down list, select 2048 for the CA certificate key pair. 
  9. From the Signature Algorithm drop-down list, select the signature algorithm for the certificate signing request. The option available is SHA-256.
  10. In the Validity Period (in years) field, enter the validity period of the CA certificate.
  11. Click Save. The new intermediate CA is generated.

Creating a Certificate Template

To create a Certificate Template for Fleet MDM:

  1. Navigate to Dynamic PKI > Certificate Authorities.
  2. Scroll to the Certificate Templates section and click Add Certificate Template.
  3. In the Basic section, for the Name field, enter the name of the certificate template.
  4. In the Subject field, retain the default values provided.
  5. In the Display Description field, enter a suitable description for the certificate template.
  6. In the Validity Period field, type the validity period of the certificate (based on the requirement).
  7. From the Signature Algorithm drop-down list, select the signature algorithm for the certificate signing request. The option available is SHA-256.
  8. In the SAN section, retain the default values provided.
  9. In the Extended Key Usage section, from the Use Certificate For list, select Client Authentication. 
  10. Check the Notify admin on certificate expiry option and select the checkbox to send certificate expiry email notifications to all Admins.
  11. Click Save.

Creating a Device Management Platform for Fleet Integration

Creating a Device Management Platform generates an API secret and SCEP URL that are further used in configuring the payload in Fleet MDM. Follow the steps below to create the device platform:

  1. Go to Integrations Hub > Device Management Platforms.
  2. Click Add.
  3. In the Basic section, enter the name of the IDP in the Name field.
  4. In the Description field, enter a suitable description for the IDP.
  5. From the Type drop-down list, select ACME Client Certificate Enrollment Token
  6. From the Vendor drop-down list, select Other.
  7. In the Vendor Name field, enter the name as “Fleet”.
  8. Click Save. A .mobileconfig file is downloaded to your device.

Configuring Policy Management

Setting up Fleet MDM requires three policies in the JoinNow Management Portal:

  1. Policy Workflow
  2. Enrollment Policy
  3. Network Policy

Configuring a Policy Workflow

The Policy Workflow facilitates the segmentation of users and devices based on predefined criteria, associated attributes, and groups, with each segment identified as a distinct Policy Workflow. For example, the admin can create one Policy Workflow for each department, such as Marketing, Engineering, Sales, and so on. This allows admins to configure the issuance of specific certificate types or formats for each Policy Workflow through an Enrollment Policy. 

Similarly, tailored network privileges can be assigned to an individual Policy Workflow by creating a specific Network Policy, enabling precise and granular control over device network access.

To configure a Policy Workflow:

  1. Navigate to Policy Management > Policy Workflows.
  2. Click Add Policy Workflow.
  3. In the Basic section, enter the name of the policy workflow in the Name field.
  4. In the Display Description field, enter a suitable description for the policy workflow.
  5. Click Save.
  6. The page refreshes, and the Conditions tab is displayed.
  7. Select the Conditions tab.
  8. In the Conditions section, from the Core Provider drop-down list, select the device management platform created for Fleet earlier (see the Creating a Device Management Platform for Fleet Integration section).
  9. Click Update.

Configuring an Enrollment Policy

An Enrollment Policy is used to configure the type of client certificate template and the Certificate Issuer for each Policy Workflow. This mapping leverages the segmentation made in the Policy Workflow to issue an appropriate client certificate template for each Policy Workflow. For example, an admin can create one Enrollment Policy for each department, such as Finance, Marketing, or Sales, as identified in the Policy Workflow, and assign a specific certificate type as per the business requirements.  

To configure an enrollment policy:

  1. Navigate to Policy Management > Enrollment.
  2. Click Add Enrollment Policy.
  3. In the Basic section, enter the name of the enrollment policy in the Name field.
  4. In the Display Description field, enter a suitable description for the enrollment policy.

    NOTE: You must select a User Role and Device Role for enrollment. You can use a Fallback Device policy to allow enrollment based on the Role policy.
  5. Click Save.
  6. The page refreshes, and the Conditions and Settings tabs are displayed.
  7. Select the Conditions tab.
  8. In the Conditions section, from the Role drop-down list, select the policy workflow you created earlier (see the Configuring a Policy Workflow section).
  9. From the Device Role drop-down list, select DEFAULT DEVICE ROLE.
  10. Select the Settings tab.
  11. In the Settings section, from the Use Certificate Authority drop-down list, select the intermediate CA you created earlier (see the Creating an Intermediate CA section).
  12. From the Use Certificate Template drop-down list, select the template you created earlier (see the Creating a Certificate Template section).
  13. In the other settings, retain the default values.
  14. Click Update.

Configuring a Network Policy

A Network Policy is used to define network privileges for devices requesting access, with configurations based on the Policy Workflow that identifies the device. Network Policies enable the assignment of various RADIUS return attributes supported by standard WiFi controllers. For example, a Network Policy can specify that devices from the Marketing team requesting access be authorized and assigned to VLAN 2. 

Alternatively, administrators may choose not to send any RADIUS return attributes; in such cases, only an Access-Accept response is returned to the authenticating WiFi controller, provided the certificate is successfully validated.

To configure network policy:

  1. Go to Policy Management > Network.
  2. Click Add Network Policy.
  3. In the Basic section, enter the name of the network policy in the Name field.
  4. In the Display Description field, enter a suitable description for the network policy.
  5. Click Save.
  6. Select the Conditions tab.
  7. Select Match All or Match Any based on your requirements to set authentication criteria.
  8. Click Add rule.
  9. Expand Identity and click Select adjacent to the Policy Workflow option.
  10. Click Save.
  11. The Policy Workflow option appears under the Conditions tab.
  12. From the Policy Workflow Equals drop-down list, select the policy workflow you created earlier (see the Configuring a Policy Workflow section).
  13. Select the Settings tab.
  14. From the Access drop-down list, select any one of the options to allow or deny authentication requests. The default value is “Allow”.
  15. To configure MFA, select the checkbox to enable MFA.
  16. From the Perform MFA Using drop-down list, select a Core Provider for MFA.
  17. Click Add Attribute.
    1. From the Dictionary drop-down list, select Radius:IETF or Custom.
    2. From the Attribute drop-down list, select an option.
      1. Framed-Protocol
      2. Framed-IP-Address
      3. Framed-IP-NetMask
      4. Framed-Routing
      5. Filter-Id
      6. Framed-MTU
      7. Framed-Compression
      8. Reply-Message
      9. Framed-Route
      10. Framed-IPX-Network
      11. State
      12. Class
      13. Session-Timeout
      14. Tunnel-Type
      15. Tunnel-Medium-Type
      16. Tunnel-Private-Group-ID
      17. Framed-Pool
    3. In the Value text box, enter a value for the attribute.
    4. Click Save.

Configuring Fleet Portal

Creating a Fleet

  1. Log in to the Fleet portal.
  2. Navigate to Settings > Fleets from the top right corner.
  3. Click Create Fleet.
  4. In the Fleet name field, enter a name for your Fleet
  5. Click Create.

Adding Device to the Fleet

  1. Click on the created fleet.
  2. Click on Add Hosts.
  3. From the pop-up, select the required OS and copy the command to generate the Fleet agent.
  4. Run the provided command in the end-user terminal as an Administrator. A Fleet agent will be installed post successful deployment. Once the device is added to the Fleet portal, add the device to the Fleet created earlier in the Creating a Fleet section.

Turn on Apple MDM Configuration

  1. Click Settings available in the profile tab in the top right corner
  2. Navigate to Integrations > MDM and click Turn On to turn on the Apple MDM configuration.

Uploading Configuration Profile

  1. Navigate to Controls > OS Settings > Configuration Profiles.
  2. Click Add profile to add the configuration profile downloaded from the JoinNow portal in the Creating a Device Management Platform for Fleet Integration section.

    NOTE: Add the following Fleet attributes to the .mobileconfig file:
  3. Replace <Wifi Name> within the profile below with the name of your SSID 
  4. Add <String>$FLEET_VAR_CERTIFICATE_RENEWAL_ID</String> for auto-renewal of the certificate. Please find an example .mobileconfig file attached here: 
				
					<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>Attest</key>
            <true/>
            <key>ClientIdentifier</key>
            <string><SecureW2 Client Identifier></string>
            <key>DirectoryURL</key>
            <string>https://connector.securew2.com/acme/</string>
            <key>ExtendedKeyUsage</key>
            <array>
                <string>1.3.6.1.5.5.7.3.2</string>
            </array>
            <key>HardwareBound</key>
            <true/>
            <key>KeySize</key>
            <integer>384</integer>
            <key>KeyType</key>
            <string>ECSECPrimeRandom</string>
            <key>Subject</key>
            <array>
                <array>
                    <array>
                        <string>CN</string>
                        <string>e3465e75-2811-4565-83e5-2fbe36960710</string>
                    </array>
                </array>
                <array>
                    <array>
                        <string>OU</string>
                        <string>$FLEET_VAR_CERTIFICATE_RENEWAL_ID</string>
                    </array>
                </array>
            </array>

            <key>SubjectAltName</key>
            <dict>
                <key>ntPrincipalName</key>
                <string>%SerialNumber%@securew2.com</string>
            </dict>
            <key>PayloadDescription</key>
            <string>This payload requests a hardware-bound EC certificate from SecureW2 via ACME</string>
            <key>PayloadDisplayName</key>
            <string>SecureW2 ACME Certificate Enrollment - vFinal</string>
            <key>PayloadIdentifier</key>
            <string>com.securew2.mobileconfigpayload.428a7568-c159-48af-8851-35a8afa0c902.acme</string>
            <key>PayloadOrganization</key>
            <string><Organization Name></string>
            <key>PayloadType</key>
            <string>com.apple.security.acme</string>
            <key>PayloadUUID</key>
            <string>04bee422-fb34-48c5-a993-7705db35f37b</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
        <dict>
            <key>AutoJoin</key>
            <true/>
            <key>CaptiveBypass</key>
            <false/>
            <key>EncryptionType</key>
            <string>WPA2</string>
            <key>HIDDEN</key>
            <false/>
            <key>ProxyType</key>
            <string>None</string>
            <key>SSID_STR</key>
            <string><Wifi Name></string>
            <key>PayloadDisplayName</key>
            <string>SW2 Secure Wi-Fi Network</string>
            <key>PayloadIdentifier</key>
            <string>com.apple.wifi.managed.B86D4C50-84E0-42DF-8D63-71822AA4CEE4</string>
            <key>PayloadType</key>
            <string>com.apple.wifi.managed</string>
            <key>PayloadUUID</key>
            <string>B86D4C50-84E0-42DF-8D63-71822AA4CEE4</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>EAPClientConfiguration</key>
            <dict>
                <key>AcceptEAPTypes</key>
                <array>
                    <integer>13</integer>
                </array>
                <key>PayloadCertificateUUID</key>
				<string>04bee422-fb34-48c5-a993-7705db35f37b</string>
                <key>TLSTrustedServerNames</key>
                <array>
                    <string>radius01.securew2.com</string>
                </array>                
            </dict>
            <key>DisableAssociationMACRandomization</key>
            <true/>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>SecureW2 Managed ACME Identity and Wi-Fi Configuration Bundle</string>
    <key>PayloadDisplayName</key>
    <string>SecureW2 Wi-Fi and Certificate Enrollment - vFinal</string>
    <key>PayloadIdentifier</key>
    <string>Fleet.SecureW2.ComboProfile</string>
    <key>PayloadOrganization</key>
    <string><Organization Name></string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>6535f148-3142-4c2c-83cb-a7f1f7face90</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>
  1. Click Choose file to add the saved .mobileconfig file.
  2. For Target, select All hosts or Custom based on your needs.
  3. Click Add profile. The configuration profiles are now pushed to the required devices.
Reseller or MSP? Join our Partner Program