--- title: Managing Certificates and Configuring Certificate Authorities slug: device-management-apple/managing-certificates-and-configuring-certificate-authorities createdAt: 2026-10-06T07:47:37.214Z --- This section addresses components related to managing certificates and certificate authorities. Ivanti EPMM supports the use of certificates and certificate-related features for tvOS devices in every instance where iOS devices are supported. Certificates can be used for macOS devices, except in the case of certificates for AppConnect. ::::LinkArray{contentSource="DOCS" itemsPerRow="1" sortOption="DEFAULT" displayMode="LINK" sourceParentDocId="GLXTm3-8XfCX4SP2eMa5z" childrenDocs="[{"docId":"5xcbLyWVdILzjA-ORDMLS","docTitle":"Certificates overview"},{"docId":"d7_LQHY-_ng3wiU16qUtI","docTitle":"Managing certificates issued by certificate enrollment configurations"},{"docId":"dnKjSmzfgHd7lwX6VuCu5","docTitle":"Configuring certificate pinning for registered devices"},{"docId":"BNoIXcJqkYG2eTvL5R47X","docTitle":"Supported certificate scenarios"},{"docId":"Xg4KRxN9Rh2aj93j8NaP2","docTitle":"Ivanti EPMM as a certificate authority"},{"docId":"8O6RdH1ggWqoutjJHgZMv","docTitle":"Configuring Ivanti EPMM as an independent root CA (Self-Signed)"},{"docId":"l0vmU-dX-lxRGCCjiSBcN","docTitle":"Configuring Ivanti EPMM as an intermediate CA"},{"docId":"jopofQn00MsIQTl1SMthR","docTitle":"Mutual authentication between devices and Ivanti EPMM"},{"docId":"im_Hi197zLNMYIcE_RBcc","docTitle":"Certificates settings"},{"docId":"j4efo2GV2HTFAYIBLv6xA","docTitle":"Certificate Enrollment settings"},{"docId":"h-6UrvFdr73cIW_tcTXld","docTitle":"Configuring ACME Certificates"},{"docId":"t2df041cNPpTn_A7IMN6x","docTitle":"Configuring a client-provided certificate enrollment setting"},{"docId":"7nPKNQi1brGeVLuKQu16p","docTitle":"Configuring an Entrust CA"},{"docId":"qMjp0UOirOwIA1Q5fqOIR","docTitle":"Configuring a GlobalSign CA"},{"docId":"va-VCD5nBBapWSxURp7_4","docTitle":"Configuring Ivanti EPMM as the CA"},{"docId":"NrMOOZQvNPFPqGDBogKpU","docTitle":"Configuring OpenTrust CA"},{"docId":"B28GI4mzZorkrRfxn0E7B","docTitle":"Certificate Revocation Checking Configuration"},{"docId":"8v2UqaFZfElkjXb2ChQmN","docTitle":"Configuring a single file identity certificate enrollment setting"},{"docId":"sIYILJOyJnuCFCthmm1Jy","docTitle":"Configuring SCEP"},{"docId":"yJzWjGsQebsV2rRVZDfDk","docTitle":"Enabling Kerberos Authentication between EPMM and the SCEP and LDAP servers"},{"docId":"_U2yPyZblP8NPPJi-Qqw-","docTitle":"Configuring Symantec Managed PKI"},{"docId":"bIhmruhYfmEf2rFspX30r","docTitle":"Configuring Symantec Web Services Managed PKI"},{"docId":"1MY3LhR7LQ9LUWrTIdnmJ","docTitle":"Configuring DigiCert One"},{"docId":"P9RNUwn6M9j43bb8RMNsW","docTitle":"Configuring a user-provided certificate enrollment setting"},{"docId":"9nuUd0kVABe3qck3lRnLO","docTitle":"Certificate Transparency Payload"}]"} :::LinkArrayItem{headerType="NONE" docId="5xcbLyWVdILzjA-ORDMLS" displayMode="LINK"} [Certificates overview](docId:5xcbLyWVdILzjA-ORDMLS) ::: :::LinkArrayItem{headerType="NONE" docId="d7_LQHY-_ng3wiU16qUtI" displayMode="LINK"} [Managing certificates issued by certificate enrollment configurations](docId\:d7_LQHY-_ng3wiU16qUtI) ::: :::LinkArrayItem{headerType="NONE" docId="dnKjSmzfgHd7lwX6VuCu5" displayMode="LINK"} [Configuring certificate pinning for registered devices](docId\:dnKjSmzfgHd7lwX6VuCu5) ::: :::LinkArrayItem{headerType="NONE" docId="BNoIXcJqkYG2eTvL5R47X" displayMode="LINK"} [Supported certificate scenarios](docId\:BNoIXcJqkYG2eTvL5R47X) ::: :::LinkArrayItem{headerType="NONE" docId="Xg4KRxN9Rh2aj93j8NaP2" displayMode="LINK"} [Ivanti EPMM as a certificate authority](docId\:Xg4KRxN9Rh2aj93j8NaP2) ::: :::LinkArrayItem{headerType="NONE" docId="8O6RdH1ggWqoutjJHgZMv" displayMode="LINK"} [Configuring Ivanti EPMM as an independent root CA (Self-Signed)](docId:8O6RdH1ggWqoutjJHgZMv) ::: :::LinkArrayItem{headerType="NONE" docId="l0vmU-dX-lxRGCCjiSBcN" displayMode="LINK"} [Configuring Ivanti EPMM as an intermediate CA](docId\:l0vmU-dX-lxRGCCjiSBcN) ::: :::LinkArrayItem{headerType="NONE" docId="jopofQn00MsIQTl1SMthR" displayMode="LINK"} [Mutual authentication between devices and Ivanti EPMM](docId\:jopofQn00MsIQTl1SMthR) ::: :::LinkArrayItem{headerType="NONE" docId="im_Hi197zLNMYIcE_RBcc" displayMode="LINK"} [Certificates settings](docId\:im_Hi197zLNMYIcE_RBcc) ::: :::LinkArrayItem{headerType="NONE" docId="j4efo2GV2HTFAYIBLv6xA" displayMode="LINK"} [Certificate Enrollment settings](docId\:j4efo2GV2HTFAYIBLv6xA) ::: :::LinkArrayItem{headerType="NONE" docId="h-6UrvFdr73cIW_tcTXld" displayMode="LINK"} [Configuring ACME Certificates](docId\:h-6UrvFdr73cIW_tcTXld) ::: :::LinkArrayItem{headerType="NONE" docId="t2df041cNPpTn_A7IMN6x" displayMode="LINK"} [Configuring a client-provided certificate enrollment setting](docId\:t2df041cNPpTn_A7IMN6x) ::: :::LinkArrayItem{headerType="NONE" docId="7nPKNQi1brGeVLuKQu16p" displayMode="LINK"} [Configuring an Entrust CA](docId:7nPKNQi1brGeVLuKQu16p) ::: :::LinkArrayItem{headerType="NONE" docId="qMjp0UOirOwIA1Q5fqOIR" displayMode="LINK"} [Configuring a GlobalSign CA](docId\:qMjp0UOirOwIA1Q5fqOIR) ::: :::LinkArrayItem{headerType="NONE" docId="va-VCD5nBBapWSxURp7_4" displayMode="LINK"} [Configuring Ivanti EPMM as the CA](docId\:va-VCD5nBBapWSxURp7_4) ::: :::LinkArrayItem{headerType="NONE" docId="NrMOOZQvNPFPqGDBogKpU" displayMode="LINK"} [Configuring OpenTrust CA](docId\:NrMOOZQvNPFPqGDBogKpU) ::: :::LinkArrayItem{headerType="NONE" docId="B28GI4mzZorkrRfxn0E7B" displayMode="LINK"} [Certificate Revocation Checking Configuration](docId\:B28GI4mzZorkrRfxn0E7B) ::: :::LinkArrayItem{headerType="NONE" docId="8v2UqaFZfElkjXb2ChQmN" displayMode="LINK"} [Configuring a single file identity certificate enrollment setting](docId:8v2UqaFZfElkjXb2ChQmN) ::: :::LinkArrayItem{headerType="NONE" docId="sIYILJOyJnuCFCthmm1Jy" displayMode="LINK"} [Configuring SCEP](docId\:sIYILJOyJnuCFCthmm1Jy) ::: :::LinkArrayItem{headerType="NONE" docId="yJzWjGsQebsV2rRVZDfDk" displayMode="LINK"} [Enabling Kerberos Authentication between EPMM and the SCEP and LDAP servers](docId\:yJzWjGsQebsV2rRVZDfDk) ::: :::LinkArrayItem{headerType="NONE" docId="_U2yPyZblP8NPPJi-Qqw-" displayMode="LINK"} [Configuring Symantec Managed PKI](docId:_U2yPyZblP8NPPJi-Qqw-) ::: :::LinkArrayItem{headerType="NONE" docId="bIhmruhYfmEf2rFspX30r" displayMode="LINK"} [Configuring Symantec Web Services Managed PKI](docId\:bIhmruhYfmEf2rFspX30r) ::: :::LinkArrayItem{headerType="NONE" docId="1MY3LhR7LQ9LUWrTIdnmJ" displayMode="LINK"} [Configuring DigiCert One](docId:1MY3LhR7LQ9LUWrTIdnmJ) ::: :::LinkArrayItem{headerType="NONE" docId="P9RNUwn6M9j43bb8RMNsW" displayMode="LINK"} [Configuring a user-provided certificate enrollment setting](docId\:P9RNUwn6M9j43bb8RMNsW) ::: :::LinkArrayItem{headerType="NONE" docId="9nuUd0kVABe3qck3lRnLO" displayMode="LINK"} [Certificate Transparency Payload](docId:9nuUd0kVABe3qck3lRnLO) ::: ::::