Entrust PKI as a Service

Renewing enrolled certificates

When certificates are close to expiring, Microsoft Intune automatically renews them on Windows and Android devices. As reported in https://learn.microsoft.com/en-us/mem/intune/protect/certificates-profile-scep, iOS, iPadOS, and macOS devices have the following issue.

Renewal behavior on iOS/iPadOS and macOS: Certificates can only be renewed during the renewal threshold phase. In addition, the device has to be unlocked while syncing with Intune. If the renewal was not successful, the expired certificate will remain on the device and Intune does not trigger a renewal anymore. Also, Intune does not offer an option to redeploy expired certificates. Affected devices need to be excluded from the SCEP profile temporarily to remove the expired certificate and request a new one.

If iOS, iPadOS, or macOS device certificates could not auto-renew during the renewal window, you must:

  1. Remove the device from the Intune Company Portal application.
  2. Reenroll the device in the Intune Company Portal.