App-based PKI solutions such as Purebred include an app installed on a device that communicates with a CA to enroll certificates and add them to the device. You can use an app-based PKI solution to provide certificates for use by BlackBerry Dynamics apps.

To use an app-based PKI solution with iOS devices, you must add a connection between BlackBerry UEM and the PKI provider. This task is not required to use an app-based PKI solution with Android devices.

If the PKI app that retrieves certificates from the CA is not a BlackBerry Dynamics app, the BlackBerry UEM Client communicates with the PKI app to get the certificates and provide them to BlackBerry Dynamics apps.

If you send more than one certificate to devices using this method, it is recommended that you set up multiple user credential profiles with each profile using a different type of certificate. If you use a single profile instance for multiple certificates, there is no indication if any certificates are missing. For example, if a profile includes separate encryption, signing, and authentication certificates and only the signing and authentication certificates are imported, it appears on the device that the that the import was successful even though the encryption certificate is missing. However, if you set up three separate user credential profiles and the encryption certificate is missing, the issue is apparent.

Some of the steps required to use your organization's app-based PKI solution are necessary only if you use the solution with iOS devices.

Step	Action
	To use an app-based PKI solution with iOS devices, in the BlackBerry Dynamics profile, select Enable UEM Client to enroll in BlackBerry Dynamics and designate the UEM Client for App authentication delegation.
	To use an app-based PKI solution with iOS devices, connect BlackBerry UEM to your organization’s app-based PKI solution.
	To use an app-based PKI solution with iOS devices, if the PKI app is not a BlackBerry Dynamics app, configure the BlackBerry UEM Client to support app-based certificates.
	Configure BlackBerry Dynamics apps to use app-based certificates.
	Ensure that the PKI app (for example, Purebred) is installed on users' devices.
	Use the app-based PKI solution with the following devices: iOS devices: create a user credential profile to use app-based certificates. Android devices: create a user credential profile to use certificates from the native keystore.