Entrust PKI as a Service

RDN Variables

Enter a value for each variable added to the RDN Format field when Configuring Jamf in PKIaaS.

Mandatory: Yes.

Configuring the mandatory variables

Every enrollment request must provide a value for the two variables below. Enter both in the Jamf portal.

Variable name Variable value
deviceudid $UDID
certificateconfigurationname A name you choose for this certificate. See Naming each certificate on a device.

Naming each certificate on a device

A single configuration profile can install more than one certificate — for example, one for VPN and one for Wi-Fi. The certificateconfigurationname value identifies which of those certificates PKIaaS is handling.

  • When a configuration profile contains a single SCEP payload, use the name of the configuration profile.

  • When more than one SCEP payload in the same configuration profile uses the same digital identifier, give each payload a different value. A reliable convention is the configuration profile name followed by the purpose of the certificate.

    Jamf object Name certificateconfigurationname
    Configuration profile macOS-Profile —
    SCEP payload for VPN VPN macOS-Profile-VPN
    SCEP payload for Wi-Fi Wi-Fi macOS-Profile-WiFi

    Because this value distinguishes the certificates from one another, a single digital identifier can serve every certificate in the configuration profile. You do not need a separate digital identifier for each one.

Configuring the profileid variable for automated renewal

To support automated certificate renewal, add the following variable.

Variable name Variable value
profileid $PROFILE_IDENTIFIER

Where profileid is the RDN Format value set when Configuring Jamf in PKIaaS.

Using Jamf payload variables

RDN values support:

Omitting Jamf preloaded variables

Do not set the following variables, as Jamf requests always provide values for them.

Variable Value
igusername The name of the device user.
iggroup The group of enrolled devices.
devicetype The enrolled device type.