Onboard Android devices with certificates using Microsoft Intune and SCEP

In this topic, you will learn how to deploy Portnox™ Cloud certificates to Android devices via Microsoft Intune SCEP.

Important: Before you can deploy Portnox Cloud certificates via Intune SCEP, you must activate the integration between Portnox Cloud and Microsoft Intune.
Important: If your organization has some Android devices enrolled as fully managed, and other devices enrolled as personal devices with a work profile, you must repeat this entire procedure twice for the two types of profiles.

Turn on the Portnox Cloud SCEP services

In this section, you will configure Portnox™ Cloud to provide SCEP services to your devices.

If you have previously turned on the Portnox Cloud SCEP services, skip to the step in which you get the Cloud SCEP URL for Microsoft Intune.

Portnox Cloud SCEP services let devices contact the Cloud SCEP server and get a unique certificate for the device or for the specific user of the device.

  1. In the Cloud portal top menu, click on the Settings option.

  2. In the Cloud portal left-hand side menu, click on the Services > GENERAL SETTINGS > SCEP Services option.

  3. Enable integration with SCEP services.

    1. Click on the Edit link.
    2. Activate the Enable integration checkbox.
    3. Click on the Save button.
  4. Click on the  ⧉  icon next to the SCEP URL for MS Intune field to copy the SCEP URL, and paste it in a text file for later use.

Download the root CA certificate from Portnox Cloud

In this section, you will download the Portnox™ Cloud root CA certificate from the Cloud portal.

You need the root CA certificate so that your managed devices can verify the validity of cloud RADIUS servers, which have certificates signed by this root CA certificate. If the root CA certificate is not distributed to managed devices, some devices may show a security warning each time that the user connects to networks managed by Portnox Cloud.

  1. In the Cloud portal top menu, click on the Settings option.

  2. In the Cloud portal left-hand side menu, click on the Services > CLEAR RADIUS SERVICE > CLEAR RADIUS instance option.

    The right-hand pane shows the list of active servers.

  3. Click on any of the active RADIUS services to show its configuration.
  4. Click on the Download root certificate link to download the root CA certificate.

    Save the file on your disk to use it later. The default name of the file is rootCertificate.cer.

Download the tenant CA certificate from Portnox Cloud

In this section, you will download the Portnox™ Cloud tenant CA certificate from the Cloud portal and convert it to the Base-64 encoded X.509 format.

You need the tenant CA certificate from Portnox Cloud so that your managed devices can verify the validity of individual SCEP certificates, which are signed using the tenant CA certificate.

  1. In the Cloud portal top menu, click on the Settings option.

  2. In the Cloud portal left-hand side menu, click on the Services > GENERAL SETTINGS > Trusted Root Certificates option.

  3. In the Trusted Root Certificates section, click on the Download link, then save the downloaded file.

    The default name of the file is Your_tenant_name - Portnox CLEAR.pfx, for example, Vorlon - Portnox CLEAR.pfx.

  4. In Windows, right-click on the downloaded file and select Open from the context menu.

    The file will be opened in the Windows certificate manager.

  5. In the certificate manager window, open the Certificates section in the left-hand pane and then double-click on Portnox - Portnox CLEAR in the right-hand side pane.

  6. In the Certificate window, click on the Details tab and then click on the Copy to File button.

  7. In the Certificate Export Wizard, export the certificate in base-64 encoded format.

    1. In the first step of the wizard, click on the Next button.
    2. In the second step of the wizard, select the Base-64 encoded X.509 (.CER) option.
    3. In the third step of the wizard, select a file to save the exported tenant CA certificate, and click on the Next button.

      For example, save the file as tenantCertificate.cer.

    4. In the last step of the wizard, click on the Finish button. Then, close the Certificate window.

Create a profile for the root CA certificate

In this section, you will create a profile in Microsoft Intune for the downloaded Portnox™ Cloud root CA certificate.

  1. Open the Microsoft Intune portal in your browser: intune.microsoft.com.
  2. In the left-hand menu, select the Devices option.

  3. In the left-hand menu of the Devices pane, select the Configuration option.

  4. In the Devices | Configuration pane, in the Policies tab, click on the Create button and select the New Policy option.

  5. In the Create a profile pane:

    1. In the Platform field, select Android Enterprise.
    2. In the Profile type field, select the following, depending on whether you are creating the profile for fully managed devices or for personally-owned devices:
      • Fully Managed, Dedicated, and Corporate-Owned Work Profile > Trusted certificate or
      • Personally-Owned Work Profile > Trusted certificate
    3. Click on the Create button.
  6. In the Basics step of the Trusted certificate wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

    In this example, we used the name Portnox Cloud root CA Android, but you can use any name you like.

  7. In the Configuration settings step of the wizard, click on the  🗀  icon to open the downloaded root CA file and click on the Next button.

    In this example, the file has the default name rootCertificate.cer.

  8. In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.

  9. In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a trusted certificate profile for the Portnox Cloud root CA certificate.

Create a profile for the tenant CA certificate

In this section, you will create a profile in Microsoft Intune for the downloaded Portnox™ Cloud tenant CA certificate.

  1. Open the Microsoft Intune portal in your browser: intune.microsoft.com.
  2. In the left-hand menu, select the Devices option.

  3. In the left-hand menu of the Devices pane, select the Configuration option.

  4. In the Devices | Configuration pane, in the Policies tab, click on the Create button and select the New Policy option.

  5. In the Create a profile pane:

    1. In the Platform field, select Android Enterprise.
    2. In the Profile type field, select the following, depending on whether you are creating the profile for fully managed devices or for personally-owned devices:
      • Fully Managed, Dedicated, and Corporate-Owned Work Profile > Trusted certificate or
      • Personally-Owned Work Profile > Trusted certificate
    3. Click on the Create button.
  6. In the Basics step of the Trusted certificate wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

    In this example, we used the name Portnox Cloud tenant CA Android, but you can use any name you like.

  7. In the Configuration settings step of the Trusted certificates wizard, click on the  🗀  icon to open the downloaded and converted tenant CA file and click on the Next button.

    In this example, the file has the name tenantCertificate.cer.

  8. In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.

  9. In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a trusted certificate profile for the Portnox Cloud tenant CA certificate.

Create a profile for the SCEP server’s intermediate certificate

In this section, you will create a profile in Microsoft Intune for the Portnox™ Cloud SCEP server’s intermediate certificate – the Thawte TLS RSA CA G1 certificate.

Most device operating systems, such as Windows, macOS, and iOS, use HTTP requests to contact SCEP servers. However, Android requires HTTPS.

To make HTTPS requests to the Portnox cloud SCEP server, all your devices must have the SCEP server’s intermediate certificate to validate the SCEP server’s identity. The Portnox Cloud SCEP server’s intermediate certificate is the standard Thawte TLS RSA CA G1 certificate.

In many cases, the operating system of the device already has this certificate installed as one of the standard certificates, and you do not need to upload it. However, it is safer to distribute the certificate to make sure that every device can connect using SCEP via HTTPS.

  1. Download the Thawte TLS RSA CA G1 certificate from our documentation server: click here to download.

    Alternatively, you can download it directly from the DigiCert website.

  2. Open the Microsoft Intune portal in your browser: intune.microsoft.com.
  3. In the left-hand menu, select the Devices option.

  4. In the left-hand menu of the Devices pane, select the Configuration option.

  5. In the Devices | Configuration pane, in the Policies tab, click on the Create button and select the New Policy option.

  6. In the Create a profile pane:

    1. In the Platform field, select Android Enterprise.
    2. In the Profile type field, select the following, depending on whether you are creating the profile for fully managed devices or for personally-owned devices:
      • Fully Managed, Dedicated, and Corporate-Owned Work Profile > Trusted certificate or
      • Personally-Owned Work Profile > Trusted certificate
    3. Click on the Create button.
  7. In the Basics step of the Trusted certificate wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

    In this example, we used the name Portnox Cloud SCEP Cert Android, but you can use any name you like.

  8. In the Configuration settings step of the Trusted certificates wizard, click on the  🗀  icon to open the downloaded Thawte TLS RSA CA G1 certificate file and click on the Next button.

    In this example, the file has the name ThawteTLSRSACAG1.crt.

  9. In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.

  10. In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a trusted certificate profile for the Portnox Cloud SCEP server’s intermediate certificate.

Create a profile for SCEP device certificates

In this section, you will create a profile in Microsoft Intune for unique device certificates, which are generated by Portnox™ Cloud for the devices, and obtained through SCEP requests.

You need to complete this task only if you want to use devices enrolled as Android Enterprise Corporate-owned dedicated devices. If you want to use only user devices, complete the next task instead.

  1. Open the Microsoft Intune portal in your browser: intune.microsoft.com.
  2. In the left-hand menu, select the Devices option.

  3. In the left-hand menu of the Devices pane, select the Configuration option.

  4. In the Devices | Configuration pane, in the Policies tab, click on the Create button and select the New Policy option.

  5. In the Create a profile pane:

    1. In the Platform field, select Android Enterprise.
    2. In the Profile type field, select the following, depending on whether you are creating the profile for fully managed devices or for personally-owned devices:
      • Fully Managed, Dedicated, and Corporate-Owned Work Profile > SCEP certificate or
      • Personally-Owned Work Profile > SCEP certificate
    3. Click on the Create button.
  6. In the Basics step of the SCEP certificate wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

    In this example, we used the name Portnox Cloud SCEP Device Android, but you can use any name you like.

  7. In the Configuration settings step of the SCEP certificates wizard, fill in the fields as follows, and then click on the Next button.

    Adjust the proposed values to your requirements and your environment, if needed.

    1. In the Certificate type field, select Device.

    2. In the Subject name format field, enter the variables that Intune will use to fill the Subject name field of the certificate.

      For information on variables that you can use, consult Intune documentation.

      In this example, we used the format CN={{DeviceId}}, which generates the subject name on the basis of the device ID. This is the value that you should use. Otherwise, Cloud will be unable to recognize the devices, and instead of mapping them to device accounts from the authentication repository, it will create new Cloud accounts for them.

    3. In the Subject alternative name section, select the attributes and the values that Intune will use to fill the SAN fields of the certificate.

      For information on attributes and values that you can use, consult Intune documentation.

      In this example, we used the attribute Email address with the value {{DeviceId}}@intunedevice.id, which is the recommended value.

    4. In the Key usage field, select both available values.

    5. In the Key size (bits) field, we recommend that you select the 2048 option.

      Note: If you’re likely to experience network packet fragmentation due to the structure of your network, for example, due to firewalls, choose 1024 instead to prevent issues due to fragmentation. If such problems occur, see the following topic: Certificate fragmentation issues.
    6. In the Hash algorithm field, select SHA-1.

      If you are sure that all your device operating systems support newer and safer SHA-2 algorithm, you can select SHA-2 instead.

    7. In the Root Certificate section, click on the Root Certificate link and select the tenant CA certificate profile that you created in the earlier task.

      Note: Do not select the root CA certificate here. The root CA certificate is used in the network profile to confirm the identity of the cloud RADIUS servers.
    8. In the Extended key usage section, in the Predefined values column, select the Client Authentication option.

    9. In the SCEP Server URLs section, copy and paste the SCEP URL that you saved in the first task in this series.

    10. For other fields, leave the default values or adjust values to your requirements and your environment, if needed.
  8. In the Apps step of the wizard, decide if the user must approve connections for all apps or should Android grant connection permission silently for specific apps. Then, click on the Next button.
  9. In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.

  10. In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a profile for device certificates obtained through SCEP.

Create a profile for SCEP user certificates

In this section, you will create a profile in Microsoft Intune for unique user certificates, which are generated by Portnox™ Cloud for the users of devices, and obtained through SCEP requests.

You need to complete this task only if you want to use devices enrolled as Android Enterprise Corporate-owned user devices. If you want to use only dedicated devices, complete the previous task only.

  1. Open the Microsoft Intune portal in your browser: intune.microsoft.com.
  2. In the left-hand menu, select the Devices option.

  3. In the left-hand menu of the Devices pane, select the Configuration option.

  4. In the Create a profile pane:

    1. In the Platform field, select Android Enterprise.
    2. In the Profile type field, select the following, depending on whether you are creating the profile for fully managed devices or for personally-owned devices:
      • Fully Managed, Dedicated, and Corporate-Owned Work Profile > SCEP certificate or
      • Personally-Owned Work Profile > SCEP certificate
    3. Click on the Create button.
  5. In the Basics step of the SCEP certificate wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

    In this example, we used the name Portnox Cloud SCEP User Android, but you can use any name you like.

  6. In the Configuration settings step of the SCEP certificates wizard, fill in the fields as follows, and then click on the Next button.

    Adjust the proposed values to your requirements and your environment, if needed.

    1. In the Certificate type field, select User.

    2. In the Subject name format field, enter the variables that Intune will use to fill the Subject name field of the certificate.

      For information on variables that you can use, consult Intune documentation.

      In this example, we used the format CN={{UserPrincipalName}}, which generates the subject name on the basis of the user’s principal name.

    3. In the Subject alternative name section, select the attributes and the values that Intune will use to fill the SAN fields of the certificate.

      For information on attributes and values that you can use, consult Intune documentation.

      In this example, we used the attribute User principal name (UPN) with the value {{UserPrincipalName}}, and the attribute Email address with the value {{DeviceId}}@intunedevice.id.

      Note: By default, Portnox Cloud checks for user identity information in the SAN UPN field. You can use a different SAN field, but it is not recommended. For more information, see the following topic: Certificate identity information.
    4. In the Key usage field, select both available values.

    5. In the Key size (bits) field, we recommend that you select the 2048 option.

      Note: If you’re likely to experience network packet fragmentation due to the structure of your network, for example, due to firewalls, choose 1024 instead to prevent issues due to fragmentation. If such problems occur, see the following topic: Certificate fragmentation issues.
    6. In the Hash algorithm field, select SHA-1.

      If you are sure that all your device operating systems support newer and safer SHA-2 algorithm, you can select SHA-2 instead.

    7. In the Root Certificate section, click on the Root Certificate link and select the tenant CA certificate profile that you created in the earlier task.

      Note: Do not select the root CA certificate here. The root CA certificate is used in the network profile to confirm the identity of the cloud RADIUS servers.
    8. In the Extended key usage section, in the Predefined values column, select the Client Authentication option.

    9. In the SCEP Server URLs section, copy and paste the SCEP URL that you saved in the first task in this series.

    10. For other fields, leave the default values or adjust values to your requirements and your environment, if needed.
  7. In the Apps step of the wizard, decide if the user must approve connections for all apps or should Android grant connection permission silently for specific apps. Then, click on the Next button.
  8. In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.

  9. In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a profile for user certificates obtained through SCEP.

Create a profile for Wi-Fi managed by Portnox Cloud

In this section, you will create a profile in Microsoft Intune for the connection of devices to the Wi-Fi network managed by Portnox™ Cloud.

  1. Open the Microsoft Intune portal in your browser: intune.microsoft.com.
  2. In the left-hand menu, select the Devices option.

  3. In the left-hand menu of the Devices pane, select the Configuration option.

  4. In the Devices | Configuration pane, in the Policies tab, click on the Create button and select the New Policy option.

  5. In the Create a profile pane:

    1. In the Platform field, select Android Enterprise.
    2. In the Profile type field, select the following, depending on whether you are creating the profile for fully managed devices or for personally-owned devices:
      • Fully Managed, Dedicated, and Corporate-Owned Work Profile > Wi-Fi or
      • Personally-Owned Work Profile > Wi-Fi
    3. Click on the Create button.
  6. In the Basics step of the Wi-Fi wizard, in the Name field, type a name for this profile, optionally fill in the Description field, and click on the Next button.

    In this example, we used the name Portnox Cloud Wi-Fi Android, but you can use any name you like.

  7. In the Configuration settings step of the wizard, in the Wi-Fi type field, select the Enterprise option, fill in the following fields, and then click on the Next button.

    Adjust the proposed values to your requirements and your environment, if needed.

    1. In the SSID field, enter the SSID of the Wi-Fi network managed by Portnox Cloud.

    2. In the EAP type field, select the EAP-TLS option.

    3. In the Certificate server names field, type clear-rad.portnox.com.

      Note: To learn more about this option, read the following topic: Trusted certificate server names.
    4. In the Root certificate for server validation section, click on the Select a certificate profile link and select the root CA profile you created in the earlier task.

      Note: This root certificate is used to validate the RADIUS server. Do not select the tenant CA certificate here. The tenant CA certificate is used in SCEP profiles to verify the validity of SCEP certificates.
    5. In the Client Authentication section, in the Authentication method field, select the Certificates option.

    6. In the Certificates section below, click on the Certificates link and select the profiles you created earlier: the device profile or the user profile.

      Important: You can only select one authentication profile for the Wi-Fi network, so if you need to authenticate both user devices and dedicated devices, you need to use two different SSIDs and two Wi-Fi configurations.
    7. For other fields, leave the default values or adjust values to your requirements and your environment, if needed.
  8. In the Assignments step of the wizard, use relevant options to assign this profile to specific groups or all users/devices, and then click on the Next button.

  9. In the Applicability Rules step of the wizard, add rules to apply this configuration profile depending on the operating system version/edition, if necessary, and then click on the Next button.
  10. In the Review + create step of the wizard, review all the information, and then click on the Create button.

Result: You created a profile for Android devices and the Wi-Fi network managed by Portnox Cloud.