--- title: ClientCertificateInstall CSP description: Learn more about the ClientCertificateInstall CSP. ms.date: 01/31/2024 --- # ClientCertificateInstall CSP The ClientCertificateInstall configuration service provider enables the enterprise to install client certificates. A client certificate has a unique ID, which is the *\[UniqueID\]* for this configuration. Each client certificate must have different UniqueIDs for the SCEP enrollment request. > [!NOTE] > For PFX certificate installation and SCEP installation, the SyncML commands must be wrapped in atomic commands to ensure that enrollment execution isn't triggered until all settings are configured. The Enroll command must be the last item in the atomic block. The following list shows the ClientCertificateInstall configuration service provider nodes: - ./Device/Vendor/MSFT/ClientCertificateInstall - [PFXCertInstall](#devicepfxcertinstall) - [{UniqueID}](#devicepfxcertinstalluniqueid) - [ContainerName](#devicepfxcertinstalluniqueidcontainername) - [KeyLocation](#devicepfxcertinstalluniqueidkeylocation) - [PFXCertBlob](#devicepfxcertinstalluniqueidpfxcertblob) - [PFXCertPassword](#devicepfxcertinstalluniqueidpfxcertpassword) - [PFXCertPasswordEncryptionStore](#devicepfxcertinstalluniqueidpfxcertpasswordencryptionstore) - [PFXCertPasswordEncryptionType](#devicepfxcertinstalluniqueidpfxcertpasswordencryptiontype) - [PFXKeyExportable](#devicepfxcertinstalluniqueidpfxkeyexportable) - [Status](#devicepfxcertinstalluniqueidstatus) - [Thumbprint](#devicepfxcertinstalluniqueidthumbprint) - [SCEP](#devicescep) - [{UniqueID}](#devicescepuniqueid) - [CertThumbprint](#devicescepuniqueidcertthumbprint) - [ErrorCode](#devicescepuniqueiderrorcode) - [Install](#devicescepuniqueidinstall) - [AADKeyIdentifierList](#devicescepuniqueidinstallaadkeyidentifierlist) - [CAThumbprint](#devicescepuniqueidinstallcathumbprint) - [Challenge](#devicescepuniqueidinstallchallenge) - [ContainerName](#devicescepuniqueidinstallcontainername) - [CustomTextToShowInPrompt](#devicescepuniqueidinstallcustomtexttoshowinprompt) - [EKUMapping](#devicescepuniqueidinstallekumapping) - [Enroll](#devicescepuniqueidinstallenroll) - [HashAlgorithm](#devicescepuniqueidinstallhashalgorithm) - [KeyLength](#devicescepuniqueidinstallkeylength) - [KeyProtection](#devicescepuniqueidinstallkeyprotection) - [KeyUsage](#devicescepuniqueidinstallkeyusage) - [RetryCount](#devicescepuniqueidinstallretrycount) - [RetryDelay](#devicescepuniqueidinstallretrydelay) - [ServerURL](#devicescepuniqueidinstallserverurl) - [SubjectAlternativeNames](#devicescepuniqueidinstallsubjectalternativenames) - [SubjectName](#devicescepuniqueidinstallsubjectname) - [TemplateName](#devicescepuniqueidinstalltemplatename) - [ValidPeriod](#devicescepuniqueidinstallvalidperiod) - [ValidPeriodUnits](#devicescepuniqueidinstallvalidperiodunits) - [RespondentServerUrl](#devicescepuniqueidrespondentserverurl) - [Status](#devicescepuniqueidstatus) - ./User/Vendor/MSFT/ClientCertificateInstall - [PFXCertInstall](#userpfxcertinstall) - [{UniqueID}](#userpfxcertinstalluniqueid) - [ContainerName](#userpfxcertinstalluniqueidcontainername) - [KeyLocation](#userpfxcertinstalluniqueidkeylocation) - [PFXCertBlob](#userpfxcertinstalluniqueidpfxcertblob) - [PFXCertPassword](#userpfxcertinstalluniqueidpfxcertpassword) - [PFXCertPasswordEncryptionStore](#userpfxcertinstalluniqueidpfxcertpasswordencryptionstore) - [PFXCertPasswordEncryptionType](#userpfxcertinstalluniqueidpfxcertpasswordencryptiontype) - [PFXKeyExportable](#userpfxcertinstalluniqueidpfxkeyexportable) - [Status](#userpfxcertinstalluniqueidstatus) - [Thumbprint](#userpfxcertinstalluniqueidthumbprint) - [SCEP](#userscep) - [{UniqueID}](#userscepuniqueid) - [CertThumbprint](#userscepuniqueidcertthumbprint) - [ErrorCode](#userscepuniqueiderrorcode) - [Install](#userscepuniqueidinstall) - [AADKeyIdentifierList](#userscepuniqueidinstallaadkeyidentifierlist) - [CAThumbprint](#userscepuniqueidinstallcathumbprint) - [Challenge](#userscepuniqueidinstallchallenge) - [ContainerName](#userscepuniqueidinstallcontainername) - [CustomTextToShowInPrompt](#userscepuniqueidinstallcustomtexttoshowinprompt) - [EKUMapping](#userscepuniqueidinstallekumapping) - [Enroll](#userscepuniqueidinstallenroll) - [HashAlgorithm](#userscepuniqueidinstallhashalgorithm) - [KeyLength](#userscepuniqueidinstallkeylength) - [KeyProtection](#userscepuniqueidinstallkeyprotection) - [KeyUsage](#userscepuniqueidinstallkeyusage) - [RetryCount](#userscepuniqueidinstallretrycount) - [RetryDelay](#userscepuniqueidinstallretrydelay) - [ServerURL](#userscepuniqueidinstallserverurl) - [SubjectAlternativeNames](#userscepuniqueidinstallsubjectalternativenames) - [SubjectName](#userscepuniqueidinstallsubjectname) - [TemplateName](#userscepuniqueidinstalltemplatename) - [ValidPeriod](#userscepuniqueidinstallvalidperiod) - [ValidPeriodUnits](#userscepuniqueidinstallvalidperiodunits) - [RespondentServerUrl](#userscepuniqueidrespondentserverurl) - [Status](#userscepuniqueidstatus) ## Device/PFXCertInstall | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall ``` Required for PFX certificate installation. The parent node grouping the PFX cert related settings. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `node` | | Access Type | Get | ### Device/PFXCertInstall/{UniqueID} | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID} ``` Required for PFX certificate installation. A unique ID to differentiate different certificate install requests. Format is node. Calling Delete on this node, should delete the certificates and the keys that were installed by the corresponding PFX blob. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `node` | | Access Type | Add, Delete, Get, Replace | | Atomic Required | True | | Dynamic Node Naming | ServerGeneratedUniqueIdentifier | #### Device/PFXCertInstall/{UniqueID}/ContainerName | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/ContainerName ``` Optional. Specifies the NGC container name (if NGC KSP is chosen for above node). If this node isn't specified when NGC KSP is chosen, enrollment will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Get, Replace | #### Device/PFXCertInstall/{UniqueID}/KeyLocation | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/KeyLocation ``` Required for PFX certificate installation. Indicates the KeyStorage provider to target the private key installation to. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Get, Replace | **Allowed values**: | Value | Description | |:--|:--| | 1 | Install to TPM if present, fail if not present. | | 2 | Install to TPM if present. If not present, fallback to software. | | 3 | Install to software. | | 4 | Install to Windows Hello for Business (formerly known as Microsoft Passport for Work) whose name is specified. | #### Device/PFXCertInstall/{UniqueID}/PFXCertBlob | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertBlob ``` Required. [CRYPT_DATA_BLOB](/previous-versions/windows/desktop/legacy/aa381414(v=vs.85)) structure that contains a PFX packet with the exported and encrypted certificates and keys. Add on this node will trigger the addition to the PFX certificate. This requires that all the other nodes under UniqueID that are parameters for PFX installation (Container Name, KeyLocation, CertPassword, fKeyExportable) are present before this is called. This will also set the Status node to the current Status of the operation. If Add is called on this node and a blob already exists, it will fail. If Replace is called on this node, the certificates will be overwritten. If Add is called on this node for a new PFX, the certificate will be added. If Replace is called on this node when it doesn't exist, this will fail. In other words, using Replace or Add will result in the effect of either overwriting the old certificate or adding a new certificate **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `bin` | | Access Type | Add, Get, Replace | #### Device/PFXCertInstall/{UniqueID}/PFXCertPassword | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPassword ``` Password that protects the PFX blob. This is required if the PFX is password protected. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Get, Replace | #### Device/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionStore | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionStore ``` Optional. When a value of "2" is contained in PFXCertPasswordEncryptionType, specify the store name where the certificate for decrypting the PFXCertPassword is stored. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Get, Replace | | Dependency [EncryptionTypeDependency] | Dependency Type: `DependsOn`
Dependency URI: `Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType`
Dependency Allowed Value: `[2]`
Dependency Allowed Value Type: `Range`
| #### Device/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionType | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionType ``` Optional. Used to specify if the PFX certificate password is encrypted with a certificate. If the value is 0 - Password isn't encrypted 1- Password is encrypted using the MDM certificate by the MDM server 2 - Password is encrypted by a Custom Certificate by the MDM server. When this value is used here, also specify the custom store name in the PFXCertPasswordEncryptionStore node. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Get, Replace | | Default Value | 0 | **Allowed values**: | Value | Description | |:--|:--| | 0 (Default) | Password isn't encrypted. | | 1 | Password is encrypted with the MDM certificate. | | 2 | Password is encrypted with custom certificate. | #### Device/PFXCertInstall/{UniqueID}/PFXKeyExportable | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXKeyExportable ``` Optional. Used to specify if the private key installed is exportable (can be exported later). The PFX isn't exportable when it's installed to TPM. > [!NOTE] > You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `bool` | | Access Type | Add, Get, Replace | | Default Value | true | | Dependency [KeyLocationDependency] | Dependency Type: `DependsOn`
Dependency URI: `Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation`
Dependency Allowed Value: `[3]`
Dependency Allowed Value Type: `Range`
| **Allowed values**: | Value | Description | |:--|:--| | false | False. | | true (Default) | True. | #### Device/PFXCertInstall/{UniqueID}/Status | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/Status ``` Returns the error code of the PFX installation from the GetLastError command called after the PfxImportCertStore. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Get | #### Device/PFXCertInstall/{UniqueID}/Thumbprint | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/Thumbprint ``` Returns the thumbprint of the PFX certificate installed. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Get | ## Device/SCEP | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP ``` Node for SCEP. An alert is sent after the SCEP certificate is installed. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `node` | | Access Type | Get | ### Device/SCEP/{UniqueID} | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID} ``` Required for SCEP certificate installation. A unique ID to differentiate different certificate install requests. Calling Delete on this node, should delete the corresponding SCEP certificate. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `node` | | Access Type | Add, Delete, Get, Replace | | Atomic Required | True | | Dynamic Node Naming | ServerGeneratedUniqueIdentifier | #### Device/SCEP/{UniqueID}/CertThumbprint | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/CertThumbprint ``` Optional. Specify the current cert's thumbprint if certificate enrollment succeeds. It's a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. > [!NOTE] > If the certificate on the device becomes invalid (Cert expired, Cert chain isn't valid, private key deleted, etc.) then it will return an empty string. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Get | #### Device/SCEP/{UniqueID}/ErrorCode | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/ErrorCode ``` Optional. The integer value that indicates the HRESULT of the last enrollment error code. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Get | #### Device/SCEP/{UniqueID}/Install | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install ``` Required for SCEP certificate enrollment. Parent node to group SCEP cert install related request. NOTE: though the children nodes under Install support Replace commands, once the Exec command is sent to the device, the device will take the values which are set when the Exec command is accepted. The server shouldn't expect the node value change after Exec command is accepted will impact the current undergoing enrollment. The server should check the Status node value and make sure the device isn't at unknown stage before changing children node values. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `node` | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/AADKeyIdentifierList | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1703 [10.0.15063] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/AADKeyIdentifierList ``` Optional. Specify the Microsoft Entra ID Key Identifier List as a semicolon separated values. On Enroll, the values in this list are validated against the Microsoft Entra ID Key present on the device. If no match is found, enrollment will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/CAThumbprint | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/CAThumbprint ``` Required. Specify root CA thumbprint. It's a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. When client authenticates SCEP server, it checks CA cert from SCEP server whether match with this cert. If no match is found, authentication will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/Challenge | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/Challenge ``` Required for SCEP certificate enrollment. B64 encoded SCEP enrollment challenge. Challenge will be deleted shortly after the Exec command is accepted. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/ContainerName | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ContainerName ``` Optional. Specifies the NGC container name (if NGC KSP is chosen for above node). If this node isn't specified when NGC KSP is chosen, enrollment will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/CustomTextToShowInPrompt | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/CustomTextToShowInPrompt ``` Optional. Specifies the custom text to show on the NGC PIN prompt during certificate enrollment. The admin can choose to provide more contextual information for why the user needs to enter the PIN and what the certificate will be used for through this. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/EKUMapping | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/EKUMapping ``` Required. Specify extended key usages. Subjected to SCEP server configuration. The list of OIDs are separated by plus "+". Sample format: OID1+OID2+OID3. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/Enroll | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/Enroll ``` Required. Trigger the device to start the cert enrollment. The device won't notify MDM server after cert enrollment is done. The MDM server could later query the device to find out whether new cert is added. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `null` | | Access Type | Exec | ##### Device/SCEP/{UniqueID}/Install/HashAlgorithm | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/HashAlgorithm ``` Required for enrollment. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated via +. For NGC, only SHA256 is supported as the supported algorithm. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/KeyLength | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyLength ``` Required for enrollment. Specify private key length (RSA). Valid value: 1024, 2048, 4096. For NGC, only 2048 is the supported keylength. > [!NOTE] > For Windows Hello for Business (formerly known as Microsoft Passport for Work) , 2048 is the only supported key length. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | **Allowed values**: | Value | Description | |:--|:--| | 1024 | 1024. | | 2048 | 2048. | | 4096 | 4096. | ##### Device/SCEP/{UniqueID}/Install/KeyProtection | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyProtection ``` Optional. Specify where to keep the private key. Note that even it's protected by TPM, it isn't guarded with TPM PIN. SCEP enrolled cert doesn't support TPM PIN protection. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Default Value | 3 | **Allowed values**: | Value | Description | |:--|:--| | 1 | Private key protected by TPM. | | 2 | Private key protected by phone TPM if the device supports TPM. All Windows Phone 8.1 devices support TPM and will treat value 2 as 1. | | 3 (Default) | (Default) Private key saved in software KSP. | | 4 | Private key protected by Windows Hello for Business (formerly known as Microsoft Passport for Work). If this option is specified, the ContainerName must be specified, otherwise enrollment will fail. | ##### Device/SCEP/{UniqueID}/Install/KeyUsage | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyUsage ``` Required for enrollment. Specify the key usage bits (0x80, 0x20, 0xA0, etc.) for the certificate in decimal format. The value should at least have second (0x20) or forth (0x80) or both bits set. If the value doesn't have those bits set, configuration will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/RetryCount | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/RetryCount ``` Optional. Special to SCEP. Specify device retry times when the SCEP server sends pending status. Format is int. Default value is 3. Max value: the value can't be larger than 30. If it's larger than 30, the device will use 30. The min value is 0 which means no retry. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Allowed Values | Range: `[0-30]` | | Default Value | 3 | ##### Device/SCEP/{UniqueID}/Install/RetryDelay | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/RetryDelay ``` Optional. When the SCEP server sends pending status, specify device retry waiting time in minutes. Default value is: 5 The min value is 1. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Allowed Values | Range: `[0-4294967295]` | | Default Value | 5 | ##### Device/SCEP/{UniqueID}/Install/ServerURL | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ServerURL ``` Required for SCEP certificate enrollment. Specify the cert enrollment server. The server could specify multiple server URLs separated by semicolon. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/SubjectAlternativeNames | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/SubjectAlternativeNames ``` Optional. Specify subject alternative name. Multiple alternative names could be specified by this node. Each name is the combination of name format+actual name. Refer name type definition in MSDN. Each pair is separated by semicolon. E.g. multiple SAN are presented in the format of [nameformat1]+[actual name1];[name format 2]+[actual name2]. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/SubjectName | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/SubjectName ``` Required. Specify the subject name. The SubjectName value is quoted if it contains leading or trailing white space or one of the following characters: ("," "=" "+" ";" ). For more information, see [CertNameToStrA function](/windows/win32/api/wincrypt/nf-wincrypt-certnametostra#remarks). **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/TemplateName | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/TemplateName ``` Optional. OID of certificate template name. Note that this name is typically ignored by the SCEP server, therefore the MDM server typically doesn't need to provide it. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### Device/SCEP/{UniqueID}/Install/ValidPeriod | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ValidPeriod ``` Optional. Specify the units for valid period. Valid values are: Days(Default), Months, Years. MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) the SCEP server as part of certificate enrollment request. It's the server's decision on how to use this valid period to create the certificate. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | | Default Value | Days | **Allowed values**: | Value | Description | |:--|:--| | Days (Default) | Days. | | Months | Months. | | Years | Years. | ##### Device/SCEP/{UniqueID}/Install/ValidPeriodUnits | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ValidPeriodUnits ``` Optional. Specify desired number of units used in validity period. Subjected to SCEP server configuration. Default is 0. The units are defined in ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in cert template. For example, if ValidPeriod is days and ValidPeriodUnits is 30, it means the total valid duration is 30 days. > [!NOTE] > The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) the SCEP server as part of certificate enrollment request. It's the server's decision on how to use this valid period to create the certificate. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Default Value | 0 | #### Device/SCEP/{UniqueID}/RespondentServerUrl | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/RespondentServerUrl ``` Required. Returns the URL of the SCEP server that responded to the enrollment request. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Get | #### Device/SCEP/{UniqueID}/Status | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```Device ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Status ``` Required. Specify the latest status for the certificate due to enroll request. Valid values are: 1 - finished successfully 2 - pending (the device hasn't finished the action but has received the SCEP server pending response) 32 - unknown 16 - action failed. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Get | ## User/PFXCertInstall | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall ``` Required for PFX certificate installation. The parent node grouping the PFX cert related settings. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `node` | | Access Type | Get | ### User/PFXCertInstall/{UniqueID} | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID} ``` Required for PFX certificate installation. A unique ID to differentiate different certificate install requests. Format is node. Calling Delete on this node, should delete the certificates and the keys that were installed by the corresponding PFX blob. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `node` | | Access Type | Add, Delete, Get, Replace | | Atomic Required | True | | Dynamic Node Naming | ServerGeneratedUniqueIdentifier | #### User/PFXCertInstall/{UniqueID}/ContainerName | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/ContainerName ``` Optional. Specifies the NGC container name (if NGC KSP is chosen for above node). If this node isn't specified when NGC KSP is chosen, enrollment will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Get, Replace | #### User/PFXCertInstall/{UniqueID}/KeyLocation | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/KeyLocation ``` Required for PFX certificate installation. Indicates the KeyStorage provider to target the private key installation to. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Get, Replace | **Allowed values**: | Value | Description | |:--|:--| | 1 | Install to TPM if present, fail if not present. | | 2 | Install to TPM if present. If not present, fallback to software. | | 3 | Install to software. | | 4 | Install to Windows Hello for Business (formerly known as Microsoft Passport for Work) whose name is specified. | #### User/PFXCertInstall/{UniqueID}/PFXCertBlob | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertBlob ``` Required. [CRYPT_DATA_BLOB](/previous-versions/windows/desktop/legacy/aa381414(v=vs.85)) structure that contains a PFX packet with the exported and encrypted certificates and keys. Add on this node will trigger the addition to the PFX certificate. This requires that all the other nodes under UniqueID that are parameters for PFX installation (Container Name, KeyLocation, CertPassword, fKeyExportable) are present before this is called. This will also set the Status node to the current Status of the operation. If Add is called on this node and a blob already exists, it will fail. If Replace is called on this node, the certificates will be overwritten. If Add is called on this node for a new PFX, the certificate will be added. If Replace is called on this node when it doesn't exist, this will fail. In other words, using Replace or Add will result in the effect of either overwriting the old certificate or adding a new certificate **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `bin` | | Access Type | Add, Get, Replace | #### User/PFXCertInstall/{UniqueID}/PFXCertPassword | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPassword ``` Password that protects the PFX blob. This is required if the PFX is password protected. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Get, Replace | #### User/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionStore | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionStore ``` Optional. When a value of "2" is contained in PFXCertPasswordEncryptionType, specify the store name where the certificate for decrypting the PFXCertPassword is stored. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Get, Replace | | Dependency [EncryptionTypeDependency] | Dependency Type: `DependsOn`
Dependency URI: `User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/PFXCertPasswordEncryptionType`
Dependency Allowed Value: `[2]`
Dependency Allowed Value Type: `Range`
| #### User/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionType | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXCertPasswordEncryptionType ``` Optional. Used to specify if the PFX certificate password is encrypted with a certificate. If the value is 0 - Password isn't encrypted 1- Password is encrypted using the MDM certificate by the MDM server 2 - Password is encrypted by a Custom Certificate by the MDM server. When this value is used here, also specify the custom store name in the PFXCertPasswordEncryptionStore node. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Get, Replace | | Default Value | 0 | **Allowed values**: | Value | Description | |:--|:--| | 0 (Default) | Password isn't encrypted. | | 1 | Password is encrypted with the MDM certificate. | | 2 | Password is encrypted with custom certificate. | #### User/PFXCertInstall/{UniqueID}/PFXKeyExportable | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/PFXKeyExportable ``` Optional. Used to specify if the private key installed is exportable (can be exported later). > [!NOTE] > You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `bool` | | Access Type | Add, Get, Replace | | Default Value | true | | Dependency [KeyLocationDependency] | Dependency Type: `DependsOn`
Dependency URI: `User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/[UniqueID]/KeyLocation`
Dependency Allowed Value: `[3]`
Dependency Allowed Value Type: `Range`
| **Allowed values**: | Value | Description | |:--|:--| | false | False. | | true (Default) | True. | #### User/PFXCertInstall/{UniqueID}/Status | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/Status ``` Returns the error code of the PFX installation from the GetLastError command called after the PfxImportCertStore. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Get | #### User/PFXCertInstall/{UniqueID}/Thumbprint | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/{UniqueID}/Thumbprint ``` Returns the thumbprint of the PFX certificate installed. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Get | ## User/SCEP | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP ``` Node for SCEP. An alert is sent after the SCEP certificate is installed. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `node` | | Access Type | Get | ### User/SCEP/{UniqueID} | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID} ``` Required for SCEP certificate installation. A unique ID to differentiate different certificate install requests. Calling Delete on this node, should delete the corresponding SCEP certificate. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `node` | | Access Type | Add, Delete, Get, Replace | | Atomic Required | True | | Dynamic Node Naming | ServerGeneratedUniqueIdentifier | #### User/SCEP/{UniqueID}/CertThumbprint | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/CertThumbprint ``` Optional. Specify the current cert's thumbprint if certificate enrollment succeeds. It's a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. > [!NOTE] > If the certificate on the device becomes invalid (Cert expired, Cert chain isn't valid, private key deleted, etc.) then it will return an empty string. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Get | #### User/SCEP/{UniqueID}/ErrorCode | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/ErrorCode ``` Optional. The integer value that indicates the HRESULT of the last enrollment error code. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Get | #### User/SCEP/{UniqueID}/Install | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install ``` Required for SCEP certificate enrollment. Parent node to group SCEP cert install related request. NOTE: though the children nodes under Install support Replace commands, once the Exec command is sent to the device, the device will take the values which are set when the Exec command is accepted. The server shouldn't expect the node value change after Exec command is accepted will impact the current undergoing enrollment. The server should check the Status node value and make sure the device isn't at unknown stage before changing children node values. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `node` | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/AADKeyIdentifierList | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1703 [10.0.15063] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/AADKeyIdentifierList ``` Optional. Specify the Microsoft Entra ID Key Identifier List as a semicolon separated values. On Enroll, the values in this list are validated against the Microsoft Entra ID Key present on the device. If no match is found, enrollment will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/CAThumbprint | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/CAThumbprint ``` Required. Specify root CA thumbprint. It's a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. When client authenticates SCEP server, it checks CA cert from SCEP server whether match with this cert. If no match is found, authentication will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/Challenge | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/Challenge ``` Required for SCEP certificate enrollment. B64 encoded SCEP enrollment challenge. Challenge will be deleted shortly after the Exec command is accepted. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/ContainerName | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ContainerName ``` Optional. Specifies the NGC container name (if NGC KSP is chosen for above node). If this node isn't specified when NGC KSP is chosen, enrollment will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/CustomTextToShowInPrompt | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/CustomTextToShowInPrompt ``` Optional. Specifies the custom text to show on the NGC PIN prompt during certificate enrollment. The admin can choose to provide more contextual information for why the user needs to enter the PIN and what the certificate will be used for through this. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/EKUMapping | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/EKUMapping ``` Required. Specify extended key usages. Subjected to SCEP server configuration. The list of OIDs are separated by plus "+". Sample format: OID1+OID2+OID3. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/Enroll | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/Enroll ``` Required. Trigger the device to start the cert enrollment. The device won't notify MDM server after cert enrollment is done. The MDM server could later query the device to find out whether new cert is added. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `null` | | Access Type | Exec | ##### User/SCEP/{UniqueID}/Install/HashAlgorithm | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/HashAlgorithm ``` Required for enrollment. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated via +. For NGC, only SHA256 is supported as the supported algorithm. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/KeyLength | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyLength ``` Required for enrollment. Specify private key length (RSA). Valid value: 1024, 2048, 4096. For NGC, only 2048 is the supported keylength. > [!NOTE] > For Windows Hello for Business (formerly known as Microsoft Passport for Work) , 2048 is the only supported key length. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | **Allowed values**: | Value | Description | |:--|:--| | 1024 | 1024. | | 2048 | 2048. | | 4096 | 4096. | ##### User/SCEP/{UniqueID}/Install/KeyProtection | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyProtection ``` Optional. Specify where to keep the private key. Note that even it's protected by TPM, it isn't guarded with TPM PIN. SCEP enrolled cert doesn't support TPM PIN protection. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Default Value | 3 | **Allowed values**: | Value | Description | |:--|:--| | 1 | Private key protected by TPM. | | 2 | Private key protected by phone TPM if the device supports TPM. All Windows Phone 8.1 devices support TPM and will treat value 2 as 1. | | 3 (Default) | (Default) Private key saved in software KSP. | | 4 | Private key protected by Windows Hello for Business (formerly known as Microsoft Passport for Work). If this option is specified, the ContainerName must be specified, otherwise enrollment will fail. | ##### User/SCEP/{UniqueID}/Install/KeyUsage | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/KeyUsage ``` Required for enrollment. Specify the key usage bits (0x80, 0x20, 0xA0, etc.) for the certificate in decimal format. The value should at least have second (0x20) or forth (0x80) or both bits set. If the value doesn't have those bits set, configuration will fail. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/RetryCount | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/RetryCount ``` Optional. Special to SCEP. Specify device retry times when the SCEP server sends pending status. Format is int. Default value is 3. Max value: the value can't be larger than 30. If it's larger than 30, the device will use 30. The min value is 0 which means no retry. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Allowed Values | Range: `[0-30]` | | Default Value | 3 | ##### User/SCEP/{UniqueID}/Install/RetryDelay | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/RetryDelay ``` Optional. When the SCEP server sends pending status, specify device retry waiting time in minutes. Default value is: 5 The min value is 1. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Allowed Values | Range: `[0-4294967295]` | | Default Value | 5 | ##### User/SCEP/{UniqueID}/Install/ServerURL | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ServerURL ``` Required for SCEP certificate enrollment. Specify the cert enrollment server. The server could specify multiple server URLs separated by semicolon. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/SubjectAlternativeNames | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/SubjectAlternativeNames ``` Optional. Specify subject alternative name. Multiple alternative names could be specified by this node. Each name is the combination of name format+actual name. Refer name type definition in MSDN. Each pair is separated by semicolon. E.g. multiple SAN are presented in the format of [nameformat1]+[actual name1];[name format 2]+[actual name2]. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/SubjectName | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/SubjectName ``` Required. Specify the subject name. The SubjectName value is quoted if it contains leading or trailing white space or one of the following characters: ("," "=" "+" ";" ). For more information, see [CertNameToStrA function](/windows/win32/api/wincrypt/nf-wincrypt-certnametostra#remarks). **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/TemplateName | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/TemplateName ``` Optional. OID of certificate template name. Note that this name is typically ignored by the SCEP server, therefore the MDM server typically doesn't need to provide it. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | ##### User/SCEP/{UniqueID}/Install/ValidPeriod | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ValidPeriod ``` Optional. Specify the units for valid period. Valid values are: Days(Default), Months, Years. MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) the SCEP server as part of certificate enrollment request. It's the server's decision on how to use this valid period to create the certificate. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | | Default Value | Days | **Allowed values**: | Value | Description | |:--|:--| | Days (Default) | Days. | | Months | Months. | | Years | Years. | ##### User/SCEP/{UniqueID}/Install/ValidPeriodUnits | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/ValidPeriodUnits ``` Optional. Specify desired number of units used in validity period. Subjected to SCEP server configuration. Default is 0. The units are defined in ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in cert template. For example, if ValidPeriod is days and ValidPeriodUnits is 30, it means the total valid duration is 30 days. > [!NOTE] > The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) the SCEP server as part of certificate enrollment request. It's the server's decision on how to use this valid period to create the certificate. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Add, Delete, Get, Replace | | Default Value | 0 | #### User/SCEP/{UniqueID}/RespondentServerUrl | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/RespondentServerUrl ``` Required. Returns the URL of the SCEP server that responded to the enrollment request. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Get | #### User/SCEP/{UniqueID}/Status | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | ```User ./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Status ``` Required. Specify the latest status for the certificate due to enroll request. Valid values are: 1 - finished successfully 2 - pending (the device hasn't finished the action but has received the SCEP server pending response) 32 - unknown 16 - action failed. **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `int` | | Access Type | Get | ## Examples - Enroll a client certificate through SCEP. ```xml 301 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/ node 302 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/RetryCount int 1 303 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/RetryDelay int 1 304 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/KeyUsage int 160 305 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/KeyLength int 1024 306 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/HashAlgorithm chr SHA-1 307 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/SubjectName chr CN=ContosoCSP 308 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/SubjectAlternativeNames chr 309 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/ValidPeriod chr Years 310 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/ValidPeriodUnits int 1 311 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/EKUMapping chr 1.3.6.1.4.1.311.10.3.12+1.3.6.1.4.1.311.10.3.4+1.3.6.1.4.1.311.20.2.2+1.3.6.1.5.5.7.3.2 312 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/KeyProtection int 3 313$ ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/ServerURL chr http://constoso.com/certsrv/mscep/mscep.dll 314 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/Challenge chr 1234CB055B7EBF384A9486A22B7559A5 315 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/CAThumbprint chr 12345087E648875D1DF5D9F9FF89DD10 316 ./Device/Vendor/MSFT/ClientCertificateInstall/SCEP//Install/Enroll ``` - Add a PFX certificate. The PFX certificate password is encrypted with a custom certificate from "My" store. ```xml $CmdID$ ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C $CmdID$ $CmdID$ ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/KeyLocation int 2 $CmdID$ ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/PFXCertBlob chr Base64_Encode_Cert_Blob $CmdID$ ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/PFXCertPassword chr Base64Encoded_Encrypted_Password_Blog $CmdID$ ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/PFXCertPasswordEncryptionType int 2 $CmdID$ ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/PFXCertPasswordEncryptionStore chr My $CmdID$ ./User/Vendor/MSFT/ClientCertificateInstall/PFXCertInstall/813A171D7341E1DA90D4A01878DD5328D351900C/PFXKeyExportable bool true ``` ## Related articles [Configuration service provider reference](configuration-service-provider-reference.md)