Configure ACME device attestation

The following sections describe the requirements and configuration tasks for ACME device attestation.

Before you begin

Before you configure ACME device attestation in Trust Lifecycle Manager, make sure you have the following:

Wichtig

ACME device attestation currently supports Apple devices only.

DigiCert prerequisites

Verify that your account supports ACME device attestation. To enable this feature on your account or for assistance, contact your DigiCert® account representative.
An ECDSA DigiCert® Private CA with configured root and intermediate CAs in your account. To add a root or intermediate CA, see Add CA certificates. Public CA issuance isn’t supported.

Other prerequisites

An MDM platform that supports ACME device attestation, such as Jamf Pro.
Mac running macOS 13.1 or later.

Set up ACME device attestation

Step 1: Configure your MDM platform

Configure your MDM platform to deploy ACME enrollment profiles to managed devices. The configuration steps vary by platform.

After you create a certificate profile in Trust Lifecycle Manager, a unique ACME Directory URL is generated for that profile. Copy this URL and use it as the value of the DirectoryURL setting in your MDM configuration.

Wichtig

Protect the Directory URL. The URL is unique to your certificate profile and should be shared only with trusted administrators. Trust Lifecycle Manager masks part of the URL when displaying the certificate profile to help protect it from unauthorized disclosure.

The following example shows an ACME configuration profile (with placeholder values) for Jamf Pro.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>Attest</key>
            <true/>
            <key>ClientIdentifier</key>
            <string>{client_identifier}</string>
            <key>DirectoryURL</key>
            <string>{ACME_Directory_URL}</string>
            <key>HardwareBound</key>
            <true/>
            <key>KeySize</key>
            <integer>256</integer>
            <key>KeyType</key>
            <string>ECSECPrimeRandom</string>
            <key>PayloadDisplayName</key>
            <string>{payload_display_name}</string>
            <key>PayloadIdentifier</key>
            <string>{payload_identifier}</string>
            <key>PayloadType</key>
            <string>com.sample.security.acme</string>
            <key>PayloadUUID</key>
            <string>{payload_uuid}</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>Subject</key>
            <array>
                <array>
                    <array>
                        <string>CN</string>
                        <string>{common_name}</string>
                    </array>
                </array>
            </array>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>{profile_display_name}</string>
    <key>PayloadIdentifier</key>
    <string>{profile_identifier}</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>{profile_uuid}</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

For more information, see the Apple developer documentation.

Step 2: Configure the ACME device allowlist

Trust Lifecycle Manager uses the ACME device allowlist (Account > Settings > Agent device allowlist) to control which devices can enroll certificates by using ACME device attestation. This list is configured at the account level and applies to all certificate profiles that use the 3rd-party ACME device attestation enrollment method.

From the Trust Lifecycle Manager main menu, go to Account > Settings > Agent device allowlist.
Select Add devices.
Choose any one of the following options:
- Enter device details manually: Enter the Device name, Serial number, and UDID for each device.
  Anmerkung
  For devices enrolled through an MDM platform, enter the device's permanent UDID.
  Select + Add another device to add multiple entries.
- Upload CSV file: To upload a CSV file with the device details:
  1. Select Upload CSV file.
  2. Drag and drop the CSV file, or select Browse files to locate and select it.
  3. Select Save to confirm upload.
Select Save.

You can edit or delete devices in the allowlist at any time. The allowlist also displays the status of each device.

Anmerkung

Deleting a device from the ACME device allowlist removes it from all certificate profiles that use the ACME device attestation enrollment method. Existing certificates aren’t revoked. However, the device can no longer renew certificates by using ACME device attestation.

Step 3: Create a certificate profile for ACME device attestation

Create a certificate profile that uses the 3rd-party ACME device attestation enrollment method.

From the Trust Lifecycle Manager main menu, go to Policies > Certificate profiles.
Select Create profile from template.
Select the CA Manager Device Attestation Certificate base template.
Configure the following options in the Create certificate profile wizard.
Anmerkung
The screens and options available in the wizard depend on the certificate template you started with. For more information, see Use the profile configuration wizard.
On the Primary options screen:
- Enter a name for the profile.
- Select a business unit from the dropdown list.
- Select the ECDSA issuing CA that will issue certificates from this profile.
- The 3rd-party ACME device attestation enrollment method is selected automatically.
Select Next to continue through the wizard, or select Back to return to previous screens and make changes.
Anmerkung
- On the Certificate options screen, ensure that the Key type and Key size values match the values configured in the ACME enrollment profile in your MDM platform. See Step 1: Configure your MDM platform.
- On the Standard extensions screen, Key usage values are included in issued certificates based on your selections. Only Apple-supported Extended Key Usage (EKU) values are available for selection.
- On the Additional options screen, X.509 PEM is selected automatically as the certificate delivery format.
On the Advanced settings screen, configure the ACME device attestation settings:
- Device identifier SANs: Select Include device identifier SANs if you want to include device identifiers as otherName subject alternative names (SANs) in issued certificates.
- Allowed attestation formats: The Apple attestation format is selected automatically.
- Attestation roots: Select the CA certificates used to validate device attestation during enrollment. To upload additional root or intermediate CA certificates, see Add CA certificates.
- Allowed devices: Select the devices that are allowed to enroll certificates by using this certificate profile. For more information, see Step 2: Configure the ACME device allowlist.
  Anmerkung
  If you don't select any devices, all devices in the ACME device allowlist are allowed to enroll certificates by using this certificate profile.
Select Create.
The ACME Directory URL is displayed.
Wichtig
ACME Directory URL:
This is the only time the full ACME Directory URL is displayed.
Copy and store the URL in a secure location before closing the dialog. After you close the dialog, the ACME Directory URL cannot be viewed again in Trust Lifecycle Manager.
Use this URL to configure the DirectoryURL setting in your MDM platform. For more information, see Step 1: Configure your MDM platform.

Deploy the ACME enrollment profile

Deploy the ACME enrollment profile to the target devices by using your organization's device management process. The deployment process varies depending on your MDM platform and your organization's deployment policies.

When the profile is installed on a device, Trust Lifecycle Manager automatically validates the device attestation. A certificate is then issued if the device satisfies the requirements configured in the certificate profile.

View and manage issued device certificates

After enrollment is complete, certificates issued through ACME device attestation appear in the Trust Lifecycle Manager certificate inventory (Inventory > Certificates). From there, you can search, filter, and manage issued certificates. For more information about certificate renewal, revocation, and other certificate management tasks, see Manage certificates.

In diesem Abschnitt: