Providing client certificates to devices and apps

During device activation

BlackBerry UEM

 sends certificates to devices during the activation process. Devices use these certificates to establish secure connections between the device and 

BlackBerry UEM

.

SCEP profiles

You can create SCEP profiles that devices use to connect to, and obtain client certificates from, your organization's CA using a SCEP service. Devices and 

BlackBerry Dynamics

 apps can use these certificates for certificate-based authentication and to connect to your work 

Wi-Fi

 network, work VPN, and work mail server.

Connection to your organization's PKI solution

If your organization uses a PKI solution, such as 

Entrust

 or 

OpenTrust

 software products, to issue and manage certificates, you can create user credential profiles that devices use to get client certificates from your organization's CA. 

BlackBerry Dynamics

 enabled devices use these certificates for certificate-based authentication from 

BlackBerry Dynamics

 apps. Other devices use these certificates for certificate-based authentication from the browser, and to connect to your work 

Wi-Fi

 network, work VPN, and work mail server.

Shared certificate profiles

A shared certificate profile specifies a client certificate that 

BlackBerry UEM

 sends to 

iOS

, 

macOS

, and 

Android

 devices. 

BlackBerry UEM

 sends the same client certificate to every user that the profile is assigned to.

The administrator must have access to the certificate and private key to create a shared certificate profile.

Sending client certificates to individual user accounts

You can add a client certificate to a user account. 

BlackBerry UEM

 can send the certificate to the user's 

iOS

 and 

Android

 devices.

If the certificate is associated with a user credential profile, devices can use these certificates to connect to your work 

Wi-Fi

 network, work VPN, and work mail server.

The administrator must have access to the certificate and private key to send the client certificate to the user.

User upload to 

UEM Self-Service

If your organization has an on-premises 

BlackBerry UEM

 environment, users can upload certificates to 

BlackBerry UEM Self-Service

. 

BlackBerry UEM

 then pushes the certificate to the users devices.

If the certificate is associated with a user credential profile, devices and 

BlackBerry Dynamics

 apps can use these certificates for certificate-based authentication and to connect to your work 

Wi-Fi

 network, work VPN, and work mail server.

This feature is not supported in 

BlackBerry UEM Cloud

. 

User import

On 

BlackBerry 10

 devices, users can import client certificates into the device's certificate store in the "Security and Privacy" section of the "System Settings". Certificates intended for use by the work browser or for sending S/MIME-protected messages from the work email account can be imported from the file system on the device or from a network location that is accessible from the work space.

On 

Android

 devices, users can add certificates to the device native keystore for use with 

BlackBerry Dynamics

 apps.

Smart cards

Users can import S/MIME and SSL certificates to their devices from a smart card.