SCEP

com.apple.security.scep

The payload that configures Simple Certificate Enrollment Protocol (SCEP) settings.

iOSmacOStvOS

macOS 10.7+iOS 4.0+combined

Configuration Keys (1)

Key	Type	Title	Description	Default	Range
`PayloadContent`required	dict	Payload Content	A dictionary containing the SCEP information.	—	—
`URL`required	string	URL	The SCEP URL. See Over-the-Air Profile Delivery and Configuration for more information about SCEP.	—	—
`Name`	string	Name	A string that's understood by the SCEP server; for example, a domain name like example.org. If a certificate authority has multiple CA certificates, this field can be used to distinguish which is required.	—	—
`Subject`	array	Subject	The representation of an X.500 name as an array of OID and value. For example, '/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar' translates to '[ [ ["C", "US"] ], [ ["O", "Apple Inc."] ], …, [ [ "1.2.5.3", "bar" ] ] ]'. OIDs can be represented as dotted numbers, with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).	—	—
`Challenge`	string	Challenge	A preshared secret.	—	—
`Keysize`	integer	Key Size	The key size, in bits.	1024
`CAFingerprint`	data	Fingerprint	The fingerprint of the Certificate Authority certificate.	—	—
`Key Type`	string	Key Type	Always 'RSA'.	"RSA"
`Key Usage`	integer	Key Usage	A bitmask indicating the use of the key. Possible values: - '1': Signing - '4': Encryption Some certificate authorities, such as Windows CA, support only encryption or signing, but not both at the same time.	0
`KeyIsExtractable`	boolean	Key is Extractable	If 'false', the system disables exporting the private key from the keychain.	true	—
`SubjectAltName`	dict	Subject Alt Name	The SCEP payload can specify an optional 'SubjectAltName' dictionary that provides values required by the CA for issuing a certificate. You can specify a single string or an array of strings for each key. The values you specify depend on the CA you're using, but might include DNS name, URL, or email values. For an example, see Sample Configuration Profile or Over-the-Air Profile Delivery and Configuration.	—	—
`Retries`	integer	Retries	The number of times the device should retry if the server sends a PENDING response.	3	—
`RetryDelay`	integer	Retry Delay	The number of seconds to wait between subsequent retries. The first retry is attempted without this delay.	10	—
`CertificateRenewalTimeInterval`	integer	Certificate Expiration Notification	The number of days before the certificate expires at which to start showing the expiration notification	14	—
`AllowAllAppsAccess`	boolean	Allow All Apps Access	If 'true', all apps have access to the private key.	false	—
`SCEPSubjectArrayInnerArray`	array	Array Inside SCEP Subject Array	This array holds another array which holds an OID value pair	—	—
`SCEPSubjectArrayPair`	array	Subject Array Pair	An array representing an OID and value pair.	—	—
`SCEPSubjectArrayPairItem`	string	SCEP Subject Array Pair Item	One item in the array representing a pair of OID and value	—	—
`rfc822Name`	string	RFC 822 Name	The RFC 822 (email address) string.	—	—
`dNSName`	string	DNS Name	The DNS name.	—	—
`uniformResourceIdentifier`	string	URI	The Uniform Resource Identifier.	—	—
`ntPrincipalName`	string	NT Principal Name	The NT principal name. Use an other name OID set to '1.3.6.1.4.1.311.20.2.3'.	—	—