safari iphone check certificate

Apple Platform Deployment

Intro to Apple platform deployment
Intro to declarative device management
Use declarative device management to manage Apple devices
Intro to MDM profiles
Intro to MDM payloads
About device supervision
Choose a deployment model
Intro to Apple device enrollment types
User Enrollment and MDM
Device Enrollment and MDM
Automated Device Enrollment and MDM
Deploy Apple TV
Deploy Apple Watch
Deploy Apple Vision Pro
Shared iPad overview
Prepare Shared iPad
Choose an MDM solution
Intro to planning your MDM migration
Configure your new MDM solution
Reenroll devices in MDM
Back up and restore devices
Use standards-based services
Deploy devices using Apple School Manager, Apple Business Manager, or Apple Business Essentials
Configure devices
Install apps with Apple Configurator
Add Apple devices to Apple School Manager, Apple Business Manager, or Apple Business Essentials
Configure your network for MDM
Configure devices to work with APNs
Prepare to use eSIMs with Apple devices
Use MDM to deploy devices with cellular connections
Support for private 5G and LTE networks
Optimize your Wi-Fi networks
Review aggregate throughput for Wi-Fi networks
Intro to content caching
Set up content caching
Use DNS TXT records
Advanced content caching settings
Content caching from the command line
Content caching metrics
Set up a shared internet connection
Intro to Apple identity services
Platform SSO for macOS
Enrollment SSO for iPhone and iPad
Managed Apple IDs
Service access with Managed Apple IDs
iMessage and FaceTime
Intro to single sign-on
Kerberos SSO extension
Integrate with Microsoft Entra ID
Integrate with Microsoft Exchange
Identify an iPhone, iPad, or Apple Vision Pro using Microsoft Exchange
Integrate Mac computers with Active Directory
Manage Setup Assistant
Configure Setup Assistant panes in Apple TV
Set up local macOS accounts
Plan your configuration profiles
Review MDM payloads
Review MDM restrictions
Review declarative configurations
About software updates
Test and defer software updates
Use MDM to deploy software updates
Intro to content distribution
Content distribution methods
Distribute Managed Apps
Distribute Custom Apps
Distribute Unlisted Apps
Distribute proprietary in-house apps
Distribute custom packages for Mac
Bundle IDs for native iPhone and iPad apps
Bundle IDs for native Apple TV apps
Manage login items and background tasks on Mac
How Apple devices join Wi-Fi networks
Connect to 802.1X networks
Wi-Fi roaming support
Cisco network enhancements
Wi-Fi specifications for Apple devices
VPN overview
Cisco IPsec VPN setup
Use a VPN proxy and certificate configuration
Use network relays
Filter content
Use AirPlay
Intro to device management security
Rapid Security Responses
Lock and locate devices
Erase devices
Activation Lock
Manage accessory access
Enforce password policies
Use persistent tokens
Use built-in network security features
Managed Device Attestation
Intro to certificate management
Distribute certificates
Intro to smart card integration
Supported smart card functions on iPhone and iPad
Use a smart card on iPhone and iPad
Supported smart card functions on Mac
Use a smart card on Mac
Configure a Mac for smart card–only authentication
FileVault and smart card usage
Advanced smart card options
Startup security
System and kernel extensions in macOS
Intro to FileVault
Use secure and bootstrap tokens
Manage FileVault with MDM
Mac app security enhancements
User Enrollment MDM information
Device Enrollment MDM payload list
Automated Device Enrollment MDM payload list
Payload list for iPhone and iPad
Payload list for Mac
Payload list for Apple TV
Payload list for Apple Watch
Payload list for Apple Vision Pro
Payload list for Shared iPad
Restrictions for iPhone and iPad
Restrictions for Mac
Restrictions for Apple TV
Restrictions for Apple Watch
Restrictions for Apple Vision Pro
Restrictions for supervised devices
MDM command list
MDM settings command options list
Device information queries
Device network information queries
Operating system queries
Installed app queries
Security queries
Declarative status reports
Accessibility payload settings
Active Directory Certificate payload settings
AirPlay payload settings
AirPlay Security payload settings
AirPrint payload settings
App Lock payload settings
Associated Domains payload settings
Automated Certificate Management Environment (ACME) payload settings
Autonomous Single App Mode payload settings
Calendar payload settings
Cellular payload settings
Cellular Private Network payload settings
Certificate Preference payload settings
Certificate Revocation payload settings
Certificate Transparency payload settings
Certificates payload settings
Conference Room Display payload settings
Contacts payload settings
Content Caching payload settings
Directory Service payload settings
DNS Proxy payload settings
DNS Settings payload settings
Dock payload settings
Domains payload settings
Energy Saver payload settings
Exchange ActiveSync (EAS) payload settings
Exchange Web Services (EWS) payload settings
Extensible Single Sign-on payload settings
Extensible Single Sign-on Kerberos payload settings
Extensions payload settings
FileVault payload settings
Finder payload settings
Firewall payload settings
Fonts payload settings
Global HTTP Proxy payload settings
Google Accounts payload settings
Home Screen Layout payload settings
Identification payload settings
Identity Preference payload settings
Kernel Extension Policy payload settings
LDAP payload settings
Lights Out Management payload settings
Lock Screen Message payload settings
Login Window payload settings
Managed Login Items payload settings
Mail payload settings
Wi-Fi settings
Ethernet settings
WEP, WPA, WPA2, WPA2/WPA3 settings
Dynamic WEP, WPA Enterprise, and WPA2 Enterprise settings
EAP settings
HotSpot 2.0 settings
Legacy Hotspot settings
Cisco Fastlane settings
Network Proxy Configuration settings
Network Usage Rules payload settings
Notifications payload settings
Parental Controls payload settings
Passcode payload settings
Printing payload settings
Privacy Preferences Policy Control payload settings
Relay payload settings
SCEP payload settings
Security payload settings
Setup Assistant payload settings
Single Sign-on payload settings
Smart Card payload settings
Subscribed Calendars payload settings
System Extensions payload settings
System Migration payload settings
Time Machine payload settings
TV Remote payload settings
VPN settings overview
AppLayerVPN payload settings
IKEv2 settings
IPsec settings
L2TP settings
VPN Proxy settings
Web Clips payload settings
Web Content Filter payload settings
Xsan payload settings
Declarative app configuration settings
Authentication credentials and identity asset settings
Calendar declarative settings
Certificates declarative configuration
Contacts declarative configuration
Exchange declarative configuration
Google Accounts declarative configuration
LDAP declarative configuration
Legacy interactive profile declarative configuration
Legacy profile declarative configuration
Mail declarative configuration
Passcode declarative configuration
Passkey Attestation declarative configuration
Screen Sharing declarative configuration
Service configuration files declarative configuration
Software Update declarative configuration
Subscribed Calendars declarative configuration
Join AppleSeed for IT
AppleCare support
Professional services
Deployment and management training
Apple Consultants Network
Apple web resources
Document revision history

Intro to certificate management for Apple devices

Apple devices support digital certificates and identities, giving your organization streamlined access to corporate services. These certificates can be used in a variety of ways. For example, the Safari browser can check the validity of an X.509 digital certificate and establish a secure session with up to 256-bit AES encryption. This involves verifying that the site’s identity is legitimate and that communication with the website is protected to help prevent interception of personal or confidential data. Certificates can also be used to guarantee the identity of the author or “signer” and to encrypt mail, configuration profiles, and network communications.

Using certificates with Apple devices

Apple devices include a number of preinstalled root certificates from various Certification Authorities (CAs), and iOS, iPadOS, and macOS validate the trust for these root certificates. These digital certificates can be used to securely identify a client or server, and to encrypt the communication between them using the public and private key pair. A certificate contains a public key, information about the client (or server), and is signed (verified) by a CA.

If iOS, iPadOS, or macOS can’t validate the trust chain of the signing CA, the service encounters an error. A self-signed certificate can’t be verified without user interaction. For more information, see the Apple support article List of available trusted root certificates in iOS 17, iPadOS 17, macOS 14, tvOS 17, and watchOS 10 .

iPhone, iPad, and Mac devices can update certificates wirelessly (and for Mac, over Ethernet) if any of the preinstalled root certificates become compromised. You can disable this feature using the mobile device management (MDM) restriction “Allow automatic updates to certificate trust settings,” which prevents certificates updates over wireless or wired networks.

Supported identity types

A certificate and its associated private key are known as an identity . Certificates can be freely distributed, but identities must be kept secure. The freely distributed certificate, and especially its public key, are used for encryption that can be decrypted only by the matching private key. The private key part of an identity is stored as a PKCS #12 identity certificate (.p12) file and encrypted with another key that’s protected by a passphrase. An identity can be used for authentication (such as 802.1X EAP-TLS), signing, or encryption (such as S/MIME).

The certificate and identity formats Apple devices support are:

Certificate: .cer, .crt, .der, X.509 certificates with RSA keys

Identity: .pfx, .p12

Certificate trust

If a certificate has been issued from a CA whose root isn’t in the list of trusted root certificates, iOS, iPadOS, and macOS won’t trust the certificate. This is often the case with enterprise-issuing CAs. To establish trust, use the method described in certificate deployment . This sets the trust anchor at the certificate being deployed. For multitiered public key infrastructures, it may be necessary to establish trust not only with the root certificate, but also with any intermediates in the chain. Often, enterprise trust is configured in a single configuration profile that can be updated with your MDM solution as needed without affecting other services on the device.

Root certificates on iPhone and iPad

Root certificates installed manually on an unsupervised iPhone and iPad through a profile display the following warning, “Installing the certificate “name of certificate” adds it to the list of trusted certificates on your iPhone or iPad . This certificate won’t be trusted for websites until you enable it in Certificate Trust Settings.”

The user can then trust the certificate on the device by going to Settings > General > About > Certificate Trust Settings.

Note: Root certificates installed by an MDM solution or on supervised devices disable the option to change the trust settings.

Root certificates on Mac

Certificates installed manually through a configuration profile must have an additional action performed to complete the installation. After the profile is added, the user can navigate to Settings > General > Profiles and select the profile under Downloaded.

The user can then review the details, cancel, or proceed by clicking Install. The user may need to provide a local administrator user name and password.

Note: In macOS 13 or later, by default root certificates manually installed with a configuration profile aren’t marked as trusted for TLS. If necessary, the Keychain Access app can be used to enable TLS trust. Root certificates installed by an MDM solution or on supervised devices disable the option to change the trust settings and are trusted for use with TLS.

Intermediate certificates on Mac

Intermediate certificates are issued and signed by the Certificate Authorities’ root certificate and they can be managed on a Mac using the Keychain Access app. These intermediate certificates have a shorter expiration date than most root certificates and are used by organizations so web browsers trust websites associated with an intermediate certificate. Users can locate expired intermediate certificates by viewing the System keychain in Keychain Access.