ClientCertificateInstall CSP

  • Article

Logo of Windows Insider.

Important

This CSP contains some settings that are under development and only applicable for Windows Insider Preview builds. These settings are subject to change and may have dependencies on other features or services in preview.

The ClientCertificateInstall configuration service provider enables the enterprise to install client certificates. A client certificate has a unique ID, which is the [UniqueID] for this configuration. Each client certificate must have different UniqueIDs for the SCEP enrollment request.

Note

For PFX certificate installation and SCEP installation, the SyncML commands must be wrapped in atomic commands to ensure that enrollment execution isn't triggered until all settings are configured. The Enroll command must be the last item in the atomic block.

The following list shows the ClientCertificateInstall configuration service provider nodes:

Device/PFXCertInstall

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall

Required for PFX certificate installation. The parent node grouping the PFX cert related settings.

Description framework properties:

Property name Property value
Format node
Access Type Get

Device/PFXCertInstall/{UniqueID}

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}

Required for PFX certificate installation. A unique ID to differentiate different certificate install requests.

Format is node.

Calling Delete on this node, should delete the certificates and the keys that were installed by the corresponding PFX blob.

Description framework properties:

Property name Property value
Format node
Access Type Add, Delete, Get, Replace
Atomic Required True
Dynamic Node Naming ServerGeneratedUniqueIdentifier

Device/PFXCertInstall/{UniqueID}/ContainerName

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/ContainerName

Optional.

Specifies the NGC container name (if NGC KSP is chosen for above node). If this node isn't specified when NGC KSP is chosen, enrollment will fail.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Get, Replace

Device/PFXCertInstall/{UniqueID}/KeyLocation

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/KeyLocation

Required for PFX certificate installation. Indicates the KeyStorage provider to target the private key installation to.

Description framework properties:

Property name Property value
Format int
Access Type Add, Get, Replace

Allowed values:

Value Description
1 Install to TPM if present, fail if not present.
2 Install to TPM if present. If not present, fallback to software.
3 Install to software.
4 Install to Windows Hello for Business (formerly known as Microsoft Passport for Work) whose name is specified.

Device/PFXCertInstall/{UniqueID}/PFXCertBlob

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertBlob

Required.

CRYPT_DATA_BLOB structure that contains a PFX packet with the exported and encrypted certificates and keys. Add on this node will trigger the addition to the PFX certificate. This requires that all the other nodes under UniqueID that are parameters for PFX installation (Container Name, KeyLocation, CertPassword, fKeyExportable) are present before this is called. This will also set the Status node to the current Status of the operation.

If Add is called on this node and a blob already exists, it will fail. If Replace is called on this node, the certificates will be overwritten.

If Add is called on this node for a new PFX, the certificate will be added. If Replace is called on this node when it doesn't exist, this will fail.

In other words, using Replace or Add will result in the effect of either overwriting the old certificate or adding a new certificate

Description framework properties:

Property name Property value
Format bin
Access Type Add, Get, Replace

Device/PFXCertInstall/{UniqueID}/PFXCertPassword

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPassword

Password that protects the PFX blob. This is required if the PFX is password protected.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Get, Replace

Device/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionStore

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionStore

Optional.

When a value of "2" is contained in PFXCertPasswordEncryptionType, specify the store name where the certificate for decrypting the PFXCertPassword is stored.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Get, Replace
Dependency [EncryptionTypeDependency] Dependency Type: DependsOn
Dependency URI: Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType
Dependency Allowed Value: [2]
Dependency Allowed Value Type: Range

Device/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionType

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionType

Optional. Used to specify if the PFX certificate password is encrypted with a certificate.

If the value is 0 - Password isn't encrypted 1- Password is encrypted using the MDM certificate by the MDM server 2 - Password is encrypted by a Custom Certificate by the MDM server. When this value is used here, also specify the custom store name in the PFXCertPasswordEncryptionStore node.

Description framework properties:

Property name Property value
Format int
Access Type Add, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Password isn't encrypted.
1 Password is encrypted with the MDM certificate.
2 Password is encrypted with custom certificate.

Device/PFXCertInstall/{UniqueID}/PFXKeyExportable

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXKeyExportable

Optional. Used to specify if the private key installed is exportable (can be exported later).

The PFX isn't exportable when it's installed to TPM.

Note

You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail.

Description framework properties:

Property name Property value
Format bool
Access Type Add, Get, Replace
Default Value true
Dependency [KeyLocationDependency] Dependency Type: DependsOn
Dependency URI: Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation
Dependency Allowed Value: [3]
Dependency Allowed Value Type: Range

Allowed values:

Value Description
false False.
true (Default) True.

Device/PFXCertInstall/{UniqueID}/Status

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/Status

Returns the error code of the PFX installation from the GetLastError command called after the PfxImportCertStore.

Description framework properties:

Property name Property value
Format int
Access Type Get

Device/PFXCertInstall/{UniqueID}/Thumbprint

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/Thumbprint

Returns the thumbprint of the PFX certificate installed.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Get

Device/SCEP

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP

Node for SCEP. An alert is sent after the SCEP certificate is installed.

Description framework properties:

Property name Property value
Format node
Access Type Get

Device/SCEP/{UniqueID}

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}

Required for SCEP certificate installation. A unique ID to differentiate different certificate install requests.

Calling Delete on this node, should delete the corresponding SCEP certificate.

Description framework properties:

Property name Property value
Format node
Access Type Add, Delete, Get, Replace
Atomic Required True
Dynamic Node Naming ServerGeneratedUniqueIdentifier

Device/SCEP/{UniqueID}/CertThumbprint

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/CertThumbprint

Optional. Specify the current cert's thumbprint if certificate enrollment succeeds. It's a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value.

Note

If the certificate on the device becomes invalid (Cert expired, Cert chain isn't valid, private key deleted, etc.) then it will return an empty string.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Get

Device/SCEP/{UniqueID}/ErrorCode

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/ErrorCode

Optional. The integer value that indicates the HRESULT of the last enrollment error code.

Description framework properties:

Property name Property value
Format int
Access Type Get

Device/SCEP/{UniqueID}/Install

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install

Required for SCEP certificate enrollment. Parent node to group SCEP cert install related request. NOTE: though the children nodes under Install support Replace commands, once the Exec command is sent to the device, the device will take the values which are set when the Exec command is accepted. The server shouldn't expect the node value change after Exec command is accepted will impact the current undergoing enrollment. The server should check the Status node value and make sure the device isn't at unknown stage before changing children node values.

Description framework properties:

Property name Property value
Format node
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/AADKeyIdentifierList
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1703 [10.0.15063] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/AADKeyIdentifierList

Optional. Specify the Microsoft Entra ID Key Identifier List as a semicolon separated values. On Enroll, the values in this list are validated against the Microsoft Entra ID Key present on the device. If no match is found, enrollment will fail.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/AttestPrivateKey
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows Insider Preview 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/AttestPrivateKey

Defines the attest SCEP private key behavior 0 - normal, 1 - best effort, 2 - on error, fail the installation.

Description framework properties:

Property name Property value
Format int
Access Type Add, Get
Device/SCEP/{UniqueID}/Install/CAThumbprint
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/CAThumbprint

Required. Specify root CA thumbprint. It's a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. When client authenticates SCEP server, it checks CA cert from SCEP server whether match with this cert. If no match is found, authentication will fail.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/Challenge
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/Challenge

Required for SCEP certificate enrollment. B64 encoded SCEP enrollment challenge. Challenge will be deleted shortly after the Exec command is accepted.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/ContainerName
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ContainerName

Optional.

Specifies the NGC container name (if NGC KSP is chosen for above node). If this node isn't specified when NGC KSP is chosen, enrollment will fail.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/CustomTextToShowInPrompt
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/CustomTextToShowInPrompt

Optional. Specifies the custom text to show on the NGC PIN prompt during certificate enrollment. The admin can choose to provide more contextual information for why the user needs to enter the PIN and what the certificate will be used for through this.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/EKUMapping
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/EKUMapping

Required. Specify extended key usages. Subjected to SCEP server configuration. The list of OIDs are separated by plus "+". Sample format: OID1+OID2+OID3.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/Enroll
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/Enroll

Required. Trigger the device to start the cert enrollment. The device won't notify MDM server after cert enrollment is done. The MDM server could later query the device to find out whether new cert is added.

Description framework properties:

Property name Property value
Format null
Access Type Exec
Device/SCEP/{UniqueID}/Install/HashAlgorithm
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/HashAlgorithm

Required for enrollment. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated via +.

For NGC, only SHA256 is supported as the supported algorithm.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/KeyLength
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyLength

Required for enrollment. Specify private key length (RSA).

Valid value: 1024, 2048, 4096. For NGC, only 2048 is the supported keylength.

Note

For Windows Hello for Business (formerly known as Microsoft Passport for Work) , 2048 is the only supported key length.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace

Allowed values:

Value Description
1024 1024.
2048 2048.
4096 4096.
Device/SCEP/{UniqueID}/Install/KeyProtection
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyProtection

Optional. Specify where to keep the private key. Note that even it's protected by TPM, it isn't guarded with TPM PIN.

SCEP enrolled cert doesn't support TPM PIN protection.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 3

Allowed values:

Value Description
1 Private key protected by TPM.
2 Private key protected by phone TPM if the device supports TPM. All Windows Phone 8.1 devices support TPM and will treat value 2 as 1.
3 (Default) (Default) Private key saved in software KSP.
4 Private key protected by Windows Hello for Business (formerly known as Microsoft Passport for Work). If this option is specified, the ContainerName must be specified, otherwise enrollment will fail.
Device/SCEP/{UniqueID}/Install/KeyUsage
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyUsage

Required for enrollment. Specify the key usage bits (0x80, 0x20, 0xA0, etc.) for the certificate in decimal format. The value should at least have second (0x20) or forth (0x80) or both bits set. If the value doesn't have those bits set, configuration will fail.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/RetryCount
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/RetryCount

Optional. Special to SCEP. Specify device retry times when the SCEP server sends pending status. Format is int. Default value is 3. Max value: the value can't be larger than 30. If it's larger than 30, the device will use 30.

The min value is 0 which means no retry.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Allowed Values Range: [0-30]
Default Value 3
Device/SCEP/{UniqueID}/Install/RetryDelay
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/RetryDelay

Optional. When the SCEP server sends pending status, specify device retry waiting time in minutes.

Default value is: 5 The min value is 1.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Allowed Values Range: [0-4294967295]
Default Value 5
Device/SCEP/{UniqueID}/Install/ServerURL
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ServerURL

Required for SCEP certificate enrollment. Specify the cert enrollment server. The server could specify multiple server URLs separated by semicolon.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/SubjectAlternativeNames
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/SubjectAlternativeNames

Optional. Specify subject alternative name. Multiple alternative names could be specified by this node. Each name is the combination of name format+actual name. Refer name type definition in MSDN. Each pair is separated by semicolon. E.g. multiple SAN are presented in the format of [nameformat1]+[actual name1];[name format 2]+[actual name2].

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/SubjectName
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/SubjectName

Required. Specify the subject name. The SubjectName value is quoted if it contains leading or trailing white space or one of the following characters: ("," "=" "+" ";" ).

For more information, see CertNameToStrA function.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/TemplateName
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/TemplateName

Optional. OID of certificate template name. Note that this name is typically ignored by the SCEP server, therefore the MDM server typically doesn't need to provide it.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Device/SCEP/{UniqueID}/Install/ValidPeriod
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ValidPeriod

Optional. Specify the units for valid period. Valid values are: Days(Default), Months, Years.

MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) the SCEP server as part of certificate enrollment request. It's the server's decision on how to use this valid period to create the certificate.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Default Value Days

Allowed values:

Value Description
Days (Default) Days.
Months Months.
Years Years.
Device/SCEP/{UniqueID}/Install/ValidPeriodUnits
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ValidPeriodUnits

Optional. Specify desired number of units used in validity period. Subjected to SCEP server configuration. Default is 0. The units are defined in ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in cert template. For example, if ValidPeriod is days and ValidPeriodUnits is 30, it means the total valid duration is 30 days.

Note

The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) the SCEP server as part of certificate enrollment request. It's the server's decision on how to use this valid period to create the certificate.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Device/SCEP/{UniqueID}/RespondentServerUrl

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/RespondentServerUrl

Required. Returns the URL of the SCEP server that responded to the enrollment request.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Get

Device/SCEP/{UniqueID}/Status

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Status

Required. Specify the latest status for the certificate due to enroll request.

Valid values are:

1 - finished successfully 2 - pending (the device hasn't finished the action but has received the SCEP server pending response) 32 - unknown 16 - action failed.

Description framework properties:

Property name Property value
Format int
Access Type Get

User/PFXCertInstall

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall

Required for PFX certificate installation. The parent node grouping the PFX cert related settings.

Description framework properties:

Property name Property value
Format node
Access Type Get

User/PFXCertInstall/{UniqueID}

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}

Required for PFX certificate installation. A unique ID to differentiate different certificate install requests.

Format is node.

Calling Delete on this node, should delete the certificates and the keys that were installed by the corresponding PFX blob.

Description framework properties:

Property name Property value
Format node
Access Type Add, Delete, Get, Replace
Atomic Required True
Dynamic Node Naming ServerGeneratedUniqueIdentifier

User/PFXCertInstall/{UniqueID}/ContainerName

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/ContainerName

Optional.

Specifies the NGC container name (if NGC KSP is chosen for above node). If this node isn't specified when NGC KSP is chosen, enrollment will fail.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Get, Replace

User/PFXCertInstall/{UniqueID}/KeyLocation

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/KeyLocation

Required for PFX certificate installation. Indicates the KeyStorage provider to target the private key installation to.

Description framework properties:

Property name Property value
Format int
Access Type Add, Get, Replace

Allowed values:

Value Description
1 Install to TPM if present, fail if not present.
2 Install to TPM if present. If not present, fallback to software.
3 Install to software.
4 Install to Windows Hello for Business (formerly known as Microsoft Passport for Work) whose name is specified.

User/PFXCertInstall/{UniqueID}/PFXCertBlob

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertBlob

Required.

CRYPT_DATA_BLOB structure that contains a PFX packet with the exported and encrypted certificates and keys. Add on this node will trigger the addition to the PFX certificate. This requires that all the other nodes under UniqueID that are parameters for PFX installation (Container Name, KeyLocation, CertPassword, fKeyExportable) are present before this is called. This will also set the Status node to the current Status of the operation.

If Add is called on this node and a blob already exists, it will fail. If Replace is called on this node, the certificates will be overwritten.

If Add is called on this node for a new PFX, the certificate will be added. If Replace is called on this node when it doesn't exist, this will fail.

In other words, using Replace or Add will result in the effect of either overwriting the old certificate or adding a new certificate

Description framework properties:

Property name Property value
Format bin
Access Type Add, Get, Replace

User/PFXCertInstall/{UniqueID}/PFXCertPassword

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPassword

Password that protects the PFX blob. This is required if the PFX is password protected.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Get, Replace

User/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionStore

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionStore

Optional.

When a value of "2" is contained in PFXCertPasswordEncryptionType, specify the store name where the certificate for decrypting the PFXCertPassword is stored.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Get, Replace
Dependency [EncryptionTypeDependency] Dependency Type: DependsOn
Dependency URI: User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType
Dependency Allowed Value: [2]
Dependency Allowed Value Type: Range

User/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionType

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionType

Optional. Used to specify if the PFX certificate password is encrypted with a certificate.

If the value is 0 - Password isn't encrypted 1- Password is encrypted using the MDM certificate by the MDM server 2 - Password is encrypted by a Custom Certificate by the MDM server. When this value is used here, also specify the custom store name in the PFXCertPasswordEncryptionStore node.

Description framework properties:

Property name Property value
Format int
Access Type Add, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Password isn't encrypted.
1 Password is encrypted with the MDM certificate.
2 Password is encrypted with custom certificate.

User/PFXCertInstall/{UniqueID}/PFXKeyExportable

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXKeyExportable

Optional. Used to specify if the private key installed is exportable (can be exported later).

Note

You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail.

Description framework properties:

Property name Property value
Format bool
Access Type Add, Get, Replace
Default Value true
Dependency [KeyLocationDependency] Dependency Type: DependsOn
Dependency URI: User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation
Dependency Allowed Value: [3]
Dependency Allowed Value Type: Range

Allowed values:

Value Description
false False.
true (Default) True.

User/PFXCertInstall/{UniqueID}/Status

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/Status

Returns the error code of the PFX installation from the GetLastError command called after the PfxImportCertStore.

Description framework properties:

Property name Property value
Format int
Access Type Get

User/PFXCertInstall/{UniqueID}/Thumbprint

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/Thumbprint

Returns the thumbprint of the PFX certificate installed.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Get

User/SCEP

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP

Node for SCEP. An alert is sent after the SCEP certificate is installed.

Description framework properties:

Property name Property value
Format node
Access Type Get

User/SCEP/{UniqueID}

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}

Required for SCEP certificate installation. A unique ID to differentiate different certificate install requests.

Calling Delete on this node, should delete the corresponding SCEP certificate.

Description framework properties:

Property name Property value
Format node
Access Type Add, Delete, Get, Replace
Atomic Required True
Dynamic Node Naming ServerGeneratedUniqueIdentifier

User/SCEP/{UniqueID}/CertThumbprint

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/CertThumbprint

Optional. Specify the current cert's thumbprint if certificate enrollment succeeds. It's a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value.

Note

If the certificate on the device becomes invalid (Cert expired, Cert chain isn't valid, private key deleted, etc.) then it will return an empty string.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Get

User/SCEP/{UniqueID}/ErrorCode

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/ErrorCode

Optional. The integer value that indicates the HRESULT of the last enrollment error code.

Description framework properties:

Property name Property value
Format int
Access Type Get

User/SCEP/{UniqueID}/Install

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install

Required for SCEP certificate enrollment. Parent node to group SCEP cert install related request. NOTE: though the children nodes under Install support Replace commands, once the Exec command is sent to the device, the device will take the values which are set when the Exec command is accepted. The server shouldn't expect the node value change after Exec command is accepted will impact the current undergoing enrollment. The server should check the Status node value and make sure the device isn't at unknown stage before changing children node values.

Description framework properties:

Property name Property value
Format node
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/AADKeyIdentifierList
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1703 [10.0.15063] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/AADKeyIdentifierList

Optional. Specify the Microsoft Entra ID Key Identifier List as a semicolon separated values. On Enroll, the values in this list are validated against the Microsoft Entra ID Key present on the device. If no match is found, enrollment will fail.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/AttestPrivateKey
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows Insider Preview 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/AttestPrivateKey

Defines the attest SCEP private key behavior 0 - normal, 1 - best effort, 2 - on error, fail the installation.

Description framework properties:

Property name Property value
Format int
Access Type Add, Get

Allowed values:

Value Description
0 Don't attest private key.
1 Attest key, but in case attestation failed, best effort approach - CSR is sent to the server.
2 Attest key, but in case attestation failed, fail fast (i.e release the key and not issue a CSR to the server).
User/SCEP/{UniqueID}/Install/CAThumbprint
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/CAThumbprint

Required. Specify root CA thumbprint. It's a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. When client authenticates SCEP server, it checks CA cert from SCEP server whether match with this cert. If no match is found, authentication will fail.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/Challenge
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/Challenge

Required for SCEP certificate enrollment. B64 encoded SCEP enrollment challenge. Challenge will be deleted shortly after the Exec command is accepted.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/ContainerName
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ContainerName

Optional.

Specifies the NGC container name (if NGC KSP is chosen for above node). If this node isn't specified when NGC KSP is chosen, enrollment will fail.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/CustomTextToShowInPrompt
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/CustomTextToShowInPrompt

Optional. Specifies the custom text to show on the NGC PIN prompt during certificate enrollment. The admin can choose to provide more contextual information for why the user needs to enter the PIN and what the certificate will be used for through this.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/EKUMapping
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/EKUMapping

Required. Specify extended key usages. Subjected to SCEP server configuration. The list of OIDs are separated by plus "+". Sample format: OID1+OID2+OID3.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/Enroll
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/Enroll

Required. Trigger the device to start the cert enrollment. The device won't notify MDM server after cert enrollment is done. The MDM server could later query the device to find out whether new cert is added.

Description framework properties:

Property name Property value
Format null
Access Type Exec
User/SCEP/{UniqueID}/Install/HashAlgorithm
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/HashAlgorithm

Required for enrollment. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated via +.

For NGC, only SHA256 is supported as the supported algorithm.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/KeyLength
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyLength

Required for enrollment. Specify private key length (RSA).

Valid value: 1024, 2048, 4096. For NGC, only 2048 is the supported keylength.

Note

For Windows Hello for Business (formerly known as Microsoft Passport for Work) , 2048 is the only supported key length.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace

Allowed values:

Value Description
1024 1024.
2048 2048.
4096 4096.
User/SCEP/{UniqueID}/Install/KeyProtection
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyProtection

Optional. Specify where to keep the private key. Note that even it's protected by TPM, it isn't guarded with TPM PIN.

SCEP enrolled cert doesn't support TPM PIN protection.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 3

Allowed values:

Value Description
1 Private key protected by TPM.
2 Private key protected by phone TPM if the device supports TPM. All Windows Phone 8.1 devices support TPM and will treat value 2 as 1.
3 (Default) (Default) Private key saved in software KSP.
4 Private key protected by Windows Hello for Business (formerly known as Microsoft Passport for Work). If this option is specified, the ContainerName must be specified, otherwise enrollment will fail.
User/SCEP/{UniqueID}/Install/KeyUsage
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyUsage

Required for enrollment. Specify the key usage bits (0x80, 0x20, 0xA0, etc.) for the certificate in decimal format. The value should at least have second (0x20) or forth (0x80) or both bits set. If the value doesn't have those bits set, configuration will fail.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/RetryCount
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/RetryCount

Optional. Special to SCEP. Specify device retry times when the SCEP server sends pending status. Format is int. Default value is 3. Max value: the value can't be larger than 30. If it's larger than 30, the device will use 30.

The min value is 0 which means no retry.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Allowed Values Range: [0-30]
Default Value 3
User/SCEP/{UniqueID}/Install/RetryDelay
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/RetryDelay

Optional. When the SCEP server sends pending status, specify device retry waiting time in minutes.

Default value is: 5 The min value is 1.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Allowed Values Range: [0-4294967295]
Default Value 5
User/SCEP/{UniqueID}/Install/ServerURL
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ServerURL

Required for SCEP certificate enrollment. Specify the cert enrollment server. The server could specify multiple server URLs separated by semicolon.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/SubjectAlternativeNames
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/SubjectAlternativeNames

Optional. Specify subject alternative name. Multiple alternative names could be specified by this node. Each name is the combination of name format+actual name. Refer name type definition in MSDN. Each pair is separated by semicolon. E.g. multiple SAN are presented in the format of [nameformat1]+[actual name1];[name format 2]+[actual name2].

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/SubjectName
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/SubjectName

Required. Specify the subject name. The SubjectName value is quoted if it contains leading or trailing white space or one of the following characters: ("," "=" "+" ";" ).

For more information, see CertNameToStrA function.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/TemplateName
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/TemplateName

Optional. OID of certificate template name. Note that this name is typically ignored by the SCEP server, therefore the MDM server typically doesn't need to provide it.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
User/SCEP/{UniqueID}/Install/ValidPeriod
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ValidPeriod

Optional. Specify the units for valid period. Valid values are: Days(Default), Months, Years.

MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) the SCEP server as part of certificate enrollment request. It's the server's decision on how to use this valid period to create the certificate.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Default Value Days

Allowed values:

Value Description
Days (Default) Days.
Months Months.
Years Years.
User/SCEP/{UniqueID}/Install/ValidPeriodUnits
Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ValidPeriodUnits

Optional. Specify desired number of units used in validity period. Subjected to SCEP server configuration. Default is 0. The units are defined in ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in cert template. For example, if ValidPeriod is days and ValidPeriodUnits is 30, it means the total valid duration is 30 days.

Note

The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) the SCEP server as part of certificate enrollment request. It's the server's decision on how to use this valid period to create the certificate.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

User/SCEP/{UniqueID}/RespondentServerUrl

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/RespondentServerUrl

Required. Returns the URL of the SCEP server that responded to the enrollment request.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Get

User/SCEP/{UniqueID}/Status

Scope Editions Applicable OS
✅ Device
✅ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1511 [10.0.10586] and later 
./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Status

Required. Specify the latest status for the certificate due to enroll request.

Valid values are:

1 - finished successfully 2 - pending (the device hasn't finished the action but has received the SCEP server pending response) 32 - unknown 16 - action failed.

Description framework properties:

Property name Property value
Format int
Access Type Get

Examples

  • Enroll a client certificate through SCEP.

    <SyncML xmlns="SYNCML:SYNCML1.2">
    <SyncBody>
        <Atomic>
        <Add>
            <CmdID>301</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere></LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">node</Format>
                </Meta>
            </Item>
        </Add>
        <Add>
            <CmdID>302</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/RetryCount</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">int</Format>
                </Meta>
                <Data>1</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>303</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/RetryDelay</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">int</Format>
                </Meta>
                <Data>1</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>304</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/KeyUsage</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">int</Format>
                </Meta>
                <Data>160</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>305</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/KeyLength</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">int</Format>
                </Meta>
                <Data>1024</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>306</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/HashAlgorithm</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">chr</Format>
                </Meta>
                <Data>SHA-1</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>307</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/SubjectName</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">chr</Format>
                </Meta>
                <Data>CN=ContosoCSP</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>308</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/SubjectAlternativeNames</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">chr</Format>
                </Meta>
                <Data></Data>
            </Item>
        </Add>
        <Add>
            <CmdID>309</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/ValidPeriod</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">chr</Format>
                </Meta>
                <Data>Years</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>310</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/ValidPeriodUnits</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">int</Format>
                </Meta>
                <Data>1</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>311</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/EKUMapping</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">chr</Format>
                </Meta>
                <Data>1.3.6.1.4.1.311.10.3.12+1.3.6.1.4.1.311.10.3.4+1.3.6.1.4.1.311.20.2.2+1.3.6.1.5.5.7.3.2</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>312</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/KeyProtection</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">int</Format>
                </Meta>
                <Data>3</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>313$</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/ServerURL</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">chr</Format>
                </Meta>
                <Data>http://constoso.com/certsrv/mscep/mscep.dll</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>314</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/Challenge</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">chr</Format>
                </Meta>
                <Data>1234CB055B7EBF384A9486A22B7559A5</Data>
            </Item>
        </Add>
        <Add>
            <CmdID>315</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/CAThumbprint</LocURI>
                </Target>
                <Meta>
                    <Format xmlns="syncml:metinf">chr</Format>
                </Meta>
                <Data>12345087E648875D1DF5D9F9FF89DD10</Data>
            </Item>
        </Add>
        <Exec>
            <CmdID>316</CmdID>
            <Item>
                <Target>
                    <LocURI>./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/<InsertUniqueIDHere>/Install/Enroll</LocURI>
                </Target>
            </Item>
        </Exec>
        </Atomic>
        <Final/>
    </SyncBody>
</SyncML>

  • Add a PFX certificate. The PFX certificate password is encrypted with a custom certificate from "My" store.

    <SyncML>
    <SyncBody>
            <Delete>
                <CmdID>$CmdID$</CmdID>
                <Item>
                    <Target>
                        <LocURI>./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C</LocURI>
                    </Target>
                </Item>
            </Delete>
        <Atomic>
            <CmdID>$CmdID$</CmdID>
            <Add>
                <CmdID>$CmdID$</CmdID>
                <Item>
                    <Target>
                        <LocURI>./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/KeyLocation</LocURI>
                    </Target>
                    <Meta>
                        <Format xmlns="syncml:metinf">int</Format>
                    </Meta>
                    <Data>2</Data>
                </Item>
            </Add>
            <Add>
                <CmdID>$CmdID$</CmdID>
                <Item>
                    <Target>
                        <LocURI>./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/PFXCertBlob</LocURI>
                    </Target>
                     <Meta>
                        <Format xmlns="syncml:metinf">chr</Format>
                    </Meta>
                    <Data>Base64_Encode_Cert_Blob</Data>
                </Item>
            </Add>
            <Add>
                <CmdID>$CmdID$</CmdID>
                <Item>
                    <Target>
                        <LocURI>./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/PFXCertPassword</LocURI>
                    </Target>
                     <Meta>
                        <Format xmlns="syncml:metinf">chr</Format>
                    </Meta>
                    <Data>Base64Encoded_Encrypted_Password_Blog</Data>
                </Item>
            </Add>
            <Add>
                <CmdID>$CmdID$</CmdID>
                <Item>
                    <Target>
                        <LocURI>./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/PFXCertPasswordEncryptionType</LocURI>
                    </Target>
                    <Meta>
                        <Format xmlns="syncml:metinf">int</Format>
                    </Meta>
                    <Data>2</Data>
                </Item>
            </Add>
            <Add>
                <CmdID>$CmdID$</CmdID>
                <Item>
                    <Target>
                        <LocURI>./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/PFXCertPasswordEncryptionStore</LocURI>
                    </Target>
                    <Meta>
                        <Format xmlns="syncml:metinf">chr</Format>
                    </Meta>
                    <Data>My</Data>
                </Item>
            </Add>
            <Add>
                <CmdID>$CmdID$</CmdID>
                <Item>
                    <Target>
                        <LocURI>./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/PFXKeyExportable</LocURI>
                    </Target>
                    <Meta>
                        <Format xmlns="syncml:metinf">bool</Format>
                    </Meta>
                    <Data>true</Data>
                </Item>
            </Add>
        </Atomic>
    <Final/>
    </SyncBody>
</SyncML>

Configuration service provider reference