Configuring MDM automation in VMware Workspace ONE
When using VMware Workspace ONE as MDM provider, the enrollment automation supports the following protocols.
The PKI protocol for Entrust MDMWS PKCS #12 enrollment.
The Simple Certificate Enrollment Protocol (SCEP).
See below the MDMWS certificate profiles supported by each protocol.
|
Profile |
PKI |
SCEP |
|
mdmws-digital-signature |
|
|
|
mdmws-digital-signature-key-encipherment |
|
|
|
mdmws-digital-signature-key-encipherment-clientauth |
|
|
|
mdmws-key-encipherment |
|
|
|
mdmws-non-repudiation |
|
|
|
mdmws-p12-digital-signature |
|
|
|
mdmws-p12-digital-signature-key-encipherment |
|
|
|
mdmws-p12-digital-signature-key-encipherment-clientauth |
|
|
|
mdmws-p12-key-encipherment |
|
|
|
mdmws-p12-non-repudiation |
|
|
See below for additional protocol differences.
|
|
PKI |
SCEP |
|
Private key |
Generated by the Entrust CA and delivered to Workspace One as a PKCS #12. Workspace One delivers the resulting private key and certificate to the managed device. |
Generated along with the CSR by the managed device |
|
Certificate information |
Provided to the Entrust CA using the MDMWS API. |
Contained within the CSR. |
|
CSR challenge passwords |
Not used. |
Workspace One:
The devices embed the challenge password into the CSR for SCEP enrollment. |
|
Enrollment request |
Submitted by Workspace One. |
Submitted by the managed devices to the SCEP endpoint of the Entrust CA. Optionally, you can use Workspace One as SCEP Proxy to perform SCEP against Workspace One instead of the Entrust CA. |
|
Support status |
Fully supported |
Temporarily broken because Workspace One:
We are working with Workspace One to fix this. |
Follow the steps below to automate MDM enrollment in VMware Workspace ONE.