Chat now with support
Chat with Support

Safeguard Authentication Services 4.2 - Mac OS X/macOS Administration Guide

One Identity Privileged Access Suite for Unix Installation The Authentication Services Mac OS X components Configuring the Authentication Services client Special Mac OS X features Authentication Services limitations on Mac OS X Authentication Services Group Policy for Mac OS X Certificate Autoenrollment

Add a Preference Manifest

You can add a preference manifest file to the Preference Manifests node in Group Policy Object Editor (GPOE)

To add a preference manifest

  1. Right-click on the Preference Manifests node and select Add/Remove Preference Manifests from the menu.

    The Add/Remove Preference Manifest dialog is displayed.

  2. Click Add to browse for the preference manifest file that you want to load.
  3. Click Load Defaults to reset the list to the default set of preference manifests.
  4. Click Remove to remove the selected preference manifests.
  5. Click OK to save changes and close the Add/Remove Preference Manifest dialog.

    The Preference Manifest view is updated to reflect the changes.

Certificate Autoenrollment

Certificate Autoenrollment is a feature of Authentication Services based on Microsoft Open Specifications. Certificate Autoenrollment allows Mac OS X/macOS® clients to take advantage of existing Microsoft infrastructure to automatically enroll for and install certificates. Certificate policy controls which certificates are enrolled and what properties those certificates will have.

With Certificate Autoenrollment, a public/private key pair is automatically generated according to certificate template parameters defined in Group Policy. The public key is sent to the Certification Authority (CA), and the CA responds with a new certificate corresponding to the public key, which is installed along with the private key into the appropriate system or user keychain on the Mac client.

You can use Group Policy to automatically configure which certificate enrollment policy servers to use for Certificate Autoenrollment and to periodically run Certificate Autoenrollment.

This section explains the system requirements for Certificate Autoenrollment and walks you through policy setup as well as client-side usage and troubleshooting.

Certificate Autoenrollment on Mac OS X/macOS

Most of the Certificate Autoenrollment code is implemented in Java. After this code has successfully requested a certificate from a CA, it invokes platform-specific code to store the private key and certificate in a suitable way for the operating system or for particular applications. This platform-specific code is implemented as a shell script,, in the /var/opt/quest/vascert/script directory.

The script is a platform-agnostic front end that chooses and loads a platform-specific back end script. For Mac OS X®/macOS®, the back end script is This script provides a fully functional implementation that uses the /usr/bin/security tool to integrate with Max OS X/macOS keychains.

Certificate Autoenrollment requirements and setup

Prior to installing One Identity Certificate Autoenrollment, ensure your system meets the following minimum hardware and software requirements.

Table 2: Certificate Autoenrollment: Minimum requirements
Component Requirements
Operating system

Mac OS X®/macOS® 10.12 (or later)

Java unlimited strength policy files For more information, see Java requirement: Unlimited Strength Jurisdiction Policy Files.
Authentication Services

One Identity Authentication Services version 4.1.2 (or later).

Additional software

Certificate Autoenrollment depends on services provided by a Microsoft Enterprise Certificate Authority (CA) in your environment.

In addition to Active Directory and an Enterprise CA, you must install the following software in your environment:

  • Microsoft Certificate Enrollment Web Services

In order for Certificate Autoenrollment to function on client computers, you must configure the following policies:

  • Certificate Services Client - Auto-Enrollment Group Policy
  • Certificate Services Client - Certificate Enrollment PolicyGroup Policy
  • Certificate Templates

Additionally, you must configure Java 1.6 (or later) as the default JVM for your system.

NOTE: Install JRE (Java Runtime Environment) on all platforms other than macOS; macOS requires JDK (Java Development Kit). Typing java on the command line provides instructions.

  • For Linux/UNIX operating systems, install JRE 1.6 (or later).
  • For Mac OS X (that is, your operating system tells you to get it from Apple), install what Apple provides (JRE).
  • For macOS (that is, your operating system tells you to get it from Oracle), install the JDK.


Enterprise Administrator rights to install software and configure Group Policy and Certificate Template policy (only if Certificate Autoenrollment is not already configured for Windows hosts in your environment.)

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating