Certificate Templates / Template Details

Certificate templates allow SOTI MobiControl to create dynamic certificates based on user enrollment or device authentication. For details, see Adding Certificates.

Note: Fields may differ depending on the type of certificate for which you're creating a template.
SOTI MobiControl Template Name Enter a name for your certificate template.
CA Template Name Enter the name of the certificate authority template.
Profile OID Enter the certificate profile OID that is associated with the certificate authority template.
Subject Name The subject name used to create certificates.

Click the gear icon to use macros to build the subject name. Supported macros include Enrolled User Principal Name, User Domain, User Username, User email or a Device Name, MAC Address, Serial Number or Platform.

Note: Each certificate type has specific requirements for the Subject Name field as follows:
Certificate Type Required Content
ADCS CN=%DEVICENAME%
Entrust igusername = user, iggroup = group, devicetype = device
General SCEP CN=%DEVICENAME%
Symantic seat_id=
Subject Alternative Names Click the + icon to expand the Subject Alternative Names section, in which you can add additional subject alternative names for the certificate template - see Subject Alternative Names.
Certificate Target Choose whether the certificate will be issued to a device or a user. Choose Device to decide if the certificate is provisioned to authenticated users only and to preserve the private key. If you choose User, both of those options are mandatory. Choosing User offers the best security.
Provision Certificate to Authenticated Users Only Turn on the toggle to restrict access to the certificate to authenticated users only.
Publish certificate to LDAP Turn on the toggle to publish the certificate to the user's record in LDAP.
Preserve Private Key Turn on the toggle to preserve the private key.
Key Size Choose the size of the key:
  • 1024
  • 2048
  • 4096
  • 8192
Remove Old Certificates Upon Successful Renewal Turn on the toggle to delete expired certificates from device after their replacement certificate is successfully installed.
Use Automatic Renewal Turn on the toggle to automatically renew certificates, with no intervention from the device user.
Days Before Automatic Renewal Specify the interval before a certificate is renewed.

The Use Automatic Renewal must be turned on to use this setting.
Key Protection Determine the level of protection for your key. Options are:
  • Protected
  • Protected if Supported
  • Not Protected
Note: When testing the functionality of certificate templates, ensure that the default template is used for simplicity. If a custom template must be used, ensure the following: In the Template properties, under Issuance Requirements, set Authorize Signatures to 1. For Policy type required in signature, select Application Policy. For Application Policy, select Certificate Request Agent.