> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Using Identity Certificates for 802.1X Authentication
> Deploy identity certificates for 802.1X network authentication using Iru Endpoint. Configure SCEP, certificate authorities, and Wi-Fi or Ethernet profiles.
This guide applies to Mac computers
### About Identity Certificates
In 802.1X authentication, identity certificates play a crucial role in ensuring security. They are particularly significant in the EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) method. EAP-TLS uses digital certificates to authenticate both the client (supplicant) and the server (authentication server). This mutual authentication guarantees that both parties trust each other's identity before establishing a secure connection.
Identity certificates can be used in both the [Wi-Fi Library Item](/en/endpoint/library/library-items-profiles/configure-the-wi-fi-library-item) and [Ethernet Library Item](/en/endpoint/library/library-items-profiles/configure-the-ethernet-library-item).
### Configure an Identity Certificate
Certain types of authentication require or allow you to specify an identity certificate to verify the device’s identity. These certificates can come from various sources. For network authentication, make sure the identity certificates include the Client Authentication entitlement in their Extended Key Usage (EKU). Work with your network administrator to ensure the certificate service and templates are properly configured for your network.
If you use Microsoft Active Directory Certificate Services, you can issue identity certificates through the [AD CS integration overview](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-overview). AD CS servers are added during [AD CS integration configuration](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-configure-the-integration), and certificate requests rely on the configured [AD CS computer certificate template](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-create-a-computer-certificate-template).
### Obtain an identity certificate using AD CS
You can obtain identity certificates using Microsoft Active Directory Certificate Services.
To deploy AD CS certificates, the [AD CS integration](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-overview) must be configured first.
For **Identity certificate**, choose **AD CS Certificate**.
Click **Configure AD CS Certificate** to open the AD CS configuration drawer.
Enter a **Certificate name**. This appears on the configuration profile in System Settings.
Enter a **Certificate subject**. This usually identifies the device within the certificate authority. You can use a static value or a global variable such as `$SERIAL_NUMBER`.
Add any required **Subject Alternative Names (SANs)** to send in the certificate request.
To support strong certificate mapping requirements from Windows update [KB5014754](https://support.microsoft.com/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16), add this URI SAN value: `$ADCS_STRONG_MAPPING_ID`. For full guidance, see [Active Directory Strong Certificate Mapping Configuration](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-strong-mapping-configuration).
Enter the **Template name** for the AD CS computer certificate template used to generate AD CS certificates, then select an **AD CS server** from the dropdown.
Select a **Key size**. Optionally choose **Allow apps to access the private key** and **Prevent the private key data from being extracted from the keychain** based on your security requirements.
Click **Done**.
### Obtain an Identity Certificate Using SCEP
Using the Simple Certificate Enrollment Protocol (SCEP), you can obtain identity certificates.
If you wish to have the client device acquire an identity certificate from a SCEP service, choose **SCEP** for an **Identity certificate**.
Click **Configure SCEP Certificate**. A drawer opens to allow you to configure SCEP options.
Enter the URL for the SCEP server for **URL**. Optionally, specify a **Name** as needed by your SCEP server (often the name of the CA where the SCEP service is requesting a certificate). Optionally, enter the pre-shared key as the **Challenge** the SCEP server expects. Optionally, enter the expected **Fingerprint** of the certificate authority's certificate.
Optionally, provide the name you want to appear as the certificate identity's **Subject**. You can use a static value or a global variable, such as CN=\$EMAIL.
Select **Specify Subject Alternative Names (SAN)** if you want to provide SANs for the certificate identity. For each SAN you would like to provide, click **Add SAN Type**, select the SAN type you want to add: **DNS Name**, **RFC 822 Name**, **Uniform Resource Identifier**, or **NT Principal Name**, and enter the associated value you would like to add for each SAN type. You can use a static value or use a global variable.
Choose the **Key size**. Work with your network administrator to ensure you choose a compatible key size; longer keys generally provide stronger security. For **Key usage**, choose whether to allow the keys to be used for **Signing**, **Encryption**, **Both signing and encryption**, or **None**. Work with your network administrator to determine which entitlements are necessary.
If you want the device to retry obtaining a certificate if the first attempt fails automatically, select **Retries**, then enter the number of retries to attempt. The default is 3. If you want to introduce a delay between retries, select **Retry delay** and specify the number of seconds between retries. The default is a 10-second delay between retries.
Select **Don't allow key to be extracted** to prevent exporting the certificate identity's private key from the macOS Keychain. Select **Allow access to all apps** if you want to automatically allow all apps to access and use the certificate identity's private key.
Select **Certificate expiration notification** and specify the number of days before the certificate expires to start notifying the user. The default is to notify the user 14 days before expiration. Select **Automatic profile redistribution** to automatically renew the certificate the specified number of days before it expires. The default is to automatically renew the certificate 30 days before expiration.
When **Automatic profile redistribution** is enabled, specify a user global variable in the Subject Alternative Names (SAN) if user information is required in the certificate. This is necessary because the Wi-Fi Library Item ID is added to the Common Name in the certificate's subject to track certificate renewal.
Click **Done** to save the SCEP certificate configuration.
### Import a PKCS #12 File
You can provide a single identity certificate for all configured devices by uploading a PKCS #12 formatted file. This means all devices will use the same certificate, making it harder for network administrators to identify individual devices by their login. However, it also means that if the certificate is compromised, it can be used to access the network. Revoking this certificate will block all configured devices from accessing the network.
If you wish to provide a certificate in PKCS #12 format, choose **PKCS #12** for the **Identity certificate**.
Click **Configure PKCS #12** to open the **Configure PKCS #12** drawer.
Upload the PKCS #12 encoded certificate for the **Certificate** (drag file or click to upload).
In the **Password** field, provide the password for the certificate.
If you want apps to access the private key of the certificate, select **Allow apps to access the private key**.
If you do not want the user to be able to export the private key using the keychain, select **Prevent the private data from being extracted in the keychain**.
Click **Done** to complete the PKCS #12 certificate configuration.
### Related Articles
Compare Wi-Fi authentication types and when to use enterprise vs non-enterprise options
Configure the Wi-Fi Library Item for network deployment
Configure 802.1X authentication for wired networks
Configure EAP types for 802.1X authentication