PayloadKit

Active Directory Certificate

com.apple.ADCertificate.managed

The payload that configures Active Directory Certificate settings.

macOS 10.7+
Apple schemaexclusive

Configuration Keys (13)

KeyTypeTitle
Descriptionrequired

A user-friendly description of the certification identity.

stringDescription
CertServerrequired

The fully qualified host name of the CA.

stringCertificate server
CertificateAuthorityrequired

macOS 10.8+

The name of the certificate authority (CA), which the device determines from the common name (CN) of the Active Directory entry. Valid values: CN=<your CA Name> CN='Certification Authorities' CN='Public Key Services' CN='Services' CN='Configuration' CN=<your base Domain Name>

stringCertificate authority
CertTemplaterequired

The certificate template for your environment. The default user certificate value is 'User'. The default computer certificate value is 'Machine'.

Default: "User"

stringCertificate template
CertificateAcquisitionMechanism

macOS 10.8+

This value is most commonly 'RPC'; if using web enrollment, use 'HTTP'.

Range: RPC, HTTP

stringCertificate acquisition mechanism
CertificateRenewalTimeIntervalrequired

The number of days in advance of certificate expiration that the notification center notifies the user.

Default: 14

integerCertificate renewal time interval
Keysizerequired

macOS 10.11+

The RSA key size for the certificate signing request (CSR).

Default: 2048

integerKey size
PromptForCredentials

macOS 10.8+

If 'true', the system prompts the user for credentials when is installs the profile. This key applies only to user certificates with the Manual Download profile delivery method. Omit this key for computer certificates.

Default: false

booleanPrompt for credentials
UserName

The user name with which to authenticate to the certificate server

stringUser name
Password

The password with which to authenticate to the certificate server

stringPassword
AllowAllAppsAccess

macOS 10.10+

If 'true', gives apps access to the private key.

Default: false

booleanAllow all apps access
KeyIsExtractable

macOS 10.10+

If 'true', the system allows exporting the private key.

Default: false

booleanKey is extractable
EnableAutoRenewal

macOS 10.13.4+

If 'true', the certificate obtained with this payload attempts auto-renewal. Auto-renewal can only be used with device Active Directory certificate payloads.

Default: false

booleanEnable auto renewal