User Guide

Chapter 2 Creating and Deploying Configuration Profiles 39
Credentials Settings
Use this payload to add certificates and identities to the device. For information about
supported formats, see “Certificates and Identities” on page 11.
When installing credentials, also install the intermediate certificates that are necessary
to establish a chain to a trusted certificate that’s on the device. To view a list of the
preinstalled roots, see the Apple Support article at http://support.apple.com/kb/HT2185.
If you’re adding an identify for use with Microsoft Exchange, use the Exchange payload
instead. See “Exchange Settings” on page 37.
Adding credentials on Mac OS X:
1 Click the Add (+) button.
2 In the file dialog that appears, select a PKCS1 or PKSC12 file, then click Open.
If the certificate or identity that you want to install in your Keychain, use Keychain
Access to export it in .p12 format. Keychain Access is located in /Applications/Utilities.
For help see Keychain Access Help, available in the Help menu when Keychain Access
is open.
To add multiple credentials to the configuration profile, click the Add (+) button again.
Adding credentials on Windows:
1 Click the Add (+) button.
2 Select the credential that you want to install from the Windows Certificate Store.
If the credential isn’t available in your personal certificate store, you must add it, and
the private key must be marked as exportable, which is one of the steps offered by the
certificate import wizard. Note that adding root certificates requires administrative
access to the computer, and the certificate must be added to the personal store.
If you’re using multiple configuration profiles, make sure certificates aren’t duplicated.
You cannot install multiple copies of the same certificate.
Instead of installing certificates using a configuration profile, you can let users use
Safari to download the certificates directly to their device from a webpage. Or, you can
email certificates to users. See “Installing Identities and Root Certificates” on page 55 for
more information. You can also use the SCEP Settings, below, to specify how the device
obtains certificates over-the-air when the profile is installed.