Integrating Kandji with EAP-TLS for Certificate Auto-Enrollment

The second option is that you can create a SCEP configuration using the Kandji Library. However this will still require a custom .mobileconfig to be uploaded for the Wi-Fi configuration. Creating a Blueprint lets you specify a set of behaviors and library items to be deployed to a group of devices.

1. Create a new Blueprint or use an existing Blueprint.
2. Navigate to Library > Add a New Library.
3. Select SCEP and then click Add & Configure.
   
   Here you could add the SCEP URL and the shared Key that you have received from SecureW2 Management portal and assign it to the Blueprint that was created from the previous step.
   

First we need to generate a SCEP URL and Challenge from JoinNow Management Portal

1. Navigate to Identity Management > API Tokens.
2. Click Add API Token.
3. In the Basic section, enter the name of the API token in the Name field.
4. In the Description field, enter a suitable description for the API token.
5. From the Type drop-down list, select SCEP Enrollment Token.
6. From the SCEP Vendor drop-down list, select Kandji.
7. From the Certificate Authority drop-down list, select a CA created in the JoinNow Management Portal.
   
8. Click Save.
9. A .csv file will download that contains your SCEP URL and Secret Key.
10. Paste the SCEP URL into the URL field in Kandji.
11. Paste the Secret Key into the Challenge field in Kandji.

Now navigate back to the Kandji portal to populate the other settings required for a SCEP Profile.

1. Subject Field: This field can have any variable that is desired, typically we populate this with the email.
2. Subject Alternative Name Type: Enter RFC 822 Name. This field is mandatory.
3. RFC 822 Name: Enter $SERIAL_NUMBER.
   
   Note: The $SERIAL_NUMBER will be used to encode on the certificate and would create an entry in the JoinNow Management Portal for a device. You can enter multiple values sent using RFC 822 Name separated by a semicolon.
4. NT Principal Name: Optional field and can be left blank.
   
   NOTE: RFC 822 Name is a mandatory field that needs to be sent from Kandji to encode the SAN values in a certificate.
5. Key Size: 2048(Mandatory field).
6. Key Usage: Both Signing & Encryption.
   
   NOTE: We set Key Usage as Both Signing & Encryption, but in our test lab we found that it works without selecting any option.
7. Scroll down to the Options section. Enable Automatic profile redistribution. This field is mandatory. We suggest you set the redistribution 30 days before certificate expiration.