Skip to content

Add ACME enrollment documentation with NanoCA#247

Open
keeleysam wants to merge 1 commit intomicromdm:mainfrom
keeleysam:samuel/nanomdm
Open

Add ACME enrollment documentation with NanoCA#247
keeleysam wants to merge 1 commit intomicromdm:mainfrom
keeleysam:samuel/nanomdm

Conversation

@keeleysam
Copy link
Copy Markdown

Adds documentation showing how to use ACME with NanoCA as an alternative to SCEP for device identity certificate enrollment.

NanoMDM is CA-agnostic — it validates device identity certificates via the -ca flag regardless of how they were issued. This means ACME-based enrollment requires no code changes, just a different enrollment profile and CA server.

Changes:

  • docs/enroll-acme.mobileconfig — Example enrollment profile using com.apple.security.acme with hardware-bound keys and device attestation
  • docs/quickstart-acme.md — Quickstart guide for setting up NanoCA as the ACME CA alongside NanoMDM
  • README.md — Add link to ACME quickstart, mention NanoCA as an alternative to SCEP

@jessepeterson
Copy link
Copy Markdown
Member

Fun! Couple notes:

  • I might suggest using NanoCA for the default docs — no need to bifurcate the docs (plus we've been winding down the SCEP server anyway).
  • There's a $SERIALNUMBER in the profile that doesn't seem to be explained.
  • Might also consider a more informal blog post (also a PR in the ./website directory).

Cheers!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants