---
title: Certificate Transparency Payload
slug: device-management-apple/certificate-transparency-payload
createdAt: 2026-10-06T07:47:37.456Z
---
In late 2018, Apple introduced a new Certificate Transparency policy. All certificates issued after October 15, 2018 must meet Apple's requirements to be trusted by Apple products. Aa Certificate Authority should issue a leaf certificate that meets Apple's Certificate Transparency policy by submitting it to a Certificate Transparency log and including the Signed Certificate Timestamp (SCT) when the certificate is signed, or the SCT must be provided during TLS handshake.
A Certificate Transparency payload specifies which domains or certificates to bypass Certificate Transparency enforcement.
This feature is applicable to:
- iOS 12.1.1
- MacOS 10.14.2
- tvOS 12.1.1
**Procedure **
1. In the Admin Portal, go to Policies & Configs > Configs.
2. Click Add New > Apple > iOS/macOS /tvOS > Certificate Transparency. The New Certificate Transparency Setting dialog box opens. Fill in the entries using the Certificate Transparency Settings table below.
3. Click Save.
The new configuration displays in the Configurations page.
Table: Certificate Transparency Settings
| Item | Description |
| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Enter a name for the certificate transparency configuration. |
| Description | Enter a description of the certificate transparency configuration. |
| Domains | Clicking the Add+ button adds another field in the Domains section.
A leading period can be used to match subdomains, but a domain matching rule must not match all domains within a top level domain.
For example: .sampledomain.com and .sampledomain.co.uk are allowed while .com and .co.uk are not allowed. |
| Certificate Hash for Certificates | Clicking the Add+ button adds a drop-down field for you to select.
- Hash Algorithm - string. Must be sha256. Required field.
- Hash - Created by applying the specified hash algorithm to the DER-encoding of the certificate's subjectPublicKeyInfo. See [Creating the certificate hash for certificates](docId:9nuUd0kVABe3qck3lRnLO). |
## Creating the certificate hash for certificates
To generate the data specified by the Hash key in the subjectPublicKeyInfo dictionary, use this CLI command for a PEM encoded certificate:
openssl x509 -pubkey -in example\_certificate.pem -inform pem | openssl pkey -pubin -
outform der | openssl dgst -sha256 -binary | base64
If your certificate is DER encoded, use this CLI command:
openssl x509 -pubkey -in example\_certificate.der -inform der | openssl pkey -pubin -
outform der | openssl dgst -sha256 -binary | base64
If your certificate does not have a .pem or .der extension, use the CLI file command to identify its encoding type.
$ file example\_certificate.crt
example\_certificate.crt: PEM certificate
$ file example\_certificate.cer
example\_certificate.cer: data
For more information, see the [Apple Configuration Profile Reference Guide](https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf).