Skip Navigation

Choosing profiles to send client certificates to devices

You can use different types of profiles to send client certificates to devices. The type of profile that you choose depends on how your organization uses certificates and the types of devices that your organization supports. Consider the following guidelines:
  • To use SCEP profiles, you must have a CA that supports SCEP.
  • If you have set up a connection between 
    BlackBerry UEM
     and your organization's PKI solution, use user credential profiles to send certificates to devices. You can connect directly to an 
     CA or 
  • To use client certificates for 
    , VPN, and mail server authentication, you must associate the certificate profile with a 
    , VPN, or email profile.
  • Shared certificate profiles and certificates that you add to user accounts do not keep the private key private because you must have access to the private key. Connecting to a CA using SCEP or user credential profiles is more secure because the private key is sent only to the device that the certificate was issued to.