Specifications

Managing certificates on
devices
A certificate is a digital document that binds the identity and public key of a certificate subject. Each certificate has a
corresponding private key that is stored separately. A CA signs the certificate to verify that it can be trusted.
Devices can use certificates to:
• Authenticate using SSL/TLS when it connects to web pages that use HTTPS
• Authenticate with a work messaging server
• Authenticate with a work Wi-Fi network or VPN
• Encrypt and sign email messages using S/MIME protection (BlackBerry 10 devices only)
Many certificates used for different purposes can be stored on a device. The BlackBerry Device Service sends certificates
to devices during the activation process. You can also use SCEP profiles to enroll client certificates to devices and you can
send server certificates and root certificates to all devices managed by the BlackBerry Device Service. If users have the
BlackBerry Smart Card Reader 2.0 and BlackBerry 10 version 10.1 devices, users can also import S/MIME certificates to
the device from a smart card.
Related information
S/MIME certificates and S/MIME private keys on BlackBerry 10 devices, 89
BlackBerry Smart Card Reader, 104
Certificates that the BlackBerry Device
Service and a device use to authenticate
with each other
When you install the BlackBerry Device Service, the setup application creates an enterprise management root certificate.
The BlackBerry Device Service uses the enterprise management root certificate for the following purposes:
• To sign a server certificate for the Enterprise Management Web Service component
• To sign client certificates for devices
5
Security Technical Overview Managing certificates on devices
38