Customizing Apple SCEP Template

By default, the issued certificate includes the Organization (O) field as O = BigFix . You can customize or remove this field in the Apple SCEP Template if required by your organization’s security or compliance policies. To do that, in the default Apple SCEP custom template, locate the following section:

<array>
  <array>
    <string>O</string>
    <string>BigFix</string>
  </array>
</array>

You can choose one of the following supported configurations:

Option 1: Use the Organization name defined during MDM server installation

<string>${ORGANIZATION}</string>

This automatically inserts the organization name configured during MDM server setup.

Option 2: Specify a custom organization name

<string>Example Corporation</string>

This inserts the specified organization name into the certificate.

Option 3: Remove the Organization field

You can remove the entire section if you do not want the Organization attribute included in the certificate subject.

By default, the SCEP profile requests a 2048-bit RSA key:

<key>Keysize</key>
<integer>2048</integer>

You can change this value to request a 4096-bit RSA key if required by your security policy:

<key>Keysize</key>
<integer>4096</integer>

Compatibility Considerations

Using a 4096-bit key increases cryptographic strength but may exclude older operating systems.

• 2048-bit (default):
  • Compatible with all supported iOS and macOS versions.
  • Recommended for mixed or legacy environments.
• 4096-bit (optional):
  • More secure.
  • Requires:
    • iOS 13 or later
    • macOS 14 (Sonoma) or later
  • Devices running earlier OS versions may fail certificate enrollment.