Skip Navigation

Create a user credential profile to use app-based certificates on 
iOS
 devices

  1. On the menu bar, click 
    Policies and Profiles
    .
  2. Click 
    Certificates > User credential
    .
  3. Click  .
  4. Type a name and description for the profile. Each certificate profile must have a unique name.
  5. In the 
    Certification authority connection
     drop-down list, select the name of the app you specified when you connected 
    BlackBerry UEM
     to your PKI solution. If you are using 
    Purebred
    , select the 
    BlackBerry UEM Client
  6. To specify which certificate the 
    BlackBerry Dynamics
     app will use, perform the following actions:
    1. In the 
      Key usage
       section, select the operations that the certificate supports.
      BlackBerry Dynamics
       apps will only use certificates that have at least the specified key usage value set. For example, an encryption certificate may have a key usage value of 
      Key encipherment
      . An authentication certificate may have a key usage value of 
      Digital signature
      . A signing certificate may have a key usage value of both 
      Digital signature
       and 
      Nonrepudiation
      .
    2. In the 
      Extended key usage
       section, select the functions that the certificate was issued for. 
      BlackBerry Dynamics
       apps will only use certificates if all selected extended key usage values are present in the certificate. Certificates can have additional extended key usage values.
    3. If the certificate was issued for purposes other than email, client authentication, or smart card login, select 
      Additional Object ID usage
      , click   and specify the OID for the key usage. For example, if the certificate will be used for server authentication, it may have the OID 1.3.6.1.5.5.7.3.1
    4. Beside 
      Issuers
      , click   and type the issuer name.
      BlackBerry Dynamics
       apps will only use a certificate if the specified issuer matches the 
      OpenSSL
       short-form OID in the certificate. You can copy this value from the issuer's certificate. Do not put spaces before or after the equal sign (=). For example:
      CN=Acme_cert SMIME,OU=Acme_Legal,O=Acme,C=Can CN=Acme_cert SMIME,OU=Acme_Legal,O=Acme CN=Acme_cert TLS
  7. If you want the device to delete expired certificates, select 
    Delete expired certificates
    .
    Expired encryption certificates used for S/MIME should be retained on the device to allow users to read messages that were encrypted before the certificate expired.
  8. If you want the device to delete duplicate certificates, select 
    Remove duplicate certificates
    . The device deletes the certificate that has the earliest start date.
  9. Click 
    Add
    .