Create a user credential profile to use certificates from the native keystore
You can allow the apps to use any certificate that had been added to the keystore or you can define restrictions on which certificate the app can choose. For example, if you are using an app-based PKI solution such as
You can configure the user credential profile to use certificates from the native keystore in the following situations:
- To allowBlackBerry Dynamicsapps to use a certificate from the native keystore onAndroiddevices
- To allowBlackBerry Dynamicsapps to use a certificate from the native keystore to access cryptographic tokens from PKI apps oniOSdevices
- To allow theBlackBerry Accessapp to use a certificate from the native keystore onmacOSorWindows 10devices
Purebredthat adds certificates to the native keystore, you can force the app to select a certificate issued by your
PurebredPKI solution and require that the app use certificates with specified capabilities.
"Native keystore" refers to the keystore on the device. All user credential profiles with Native keystore connectors should be assigned to the user before they start discovering certificates. If a certificate meets the requirements of more than one UCP the best match is chosen.
- On the menu bar, clickPolicies and Profiles.
- ClickCertificates > User credential.
- Click .
- Type a name and description for the profile. Each certificate profile must have a unique name.
- In theCertificate authority connectiondrop-down list, selectNative keystore.
- In theSupported platformssection, select the device OS types that you want this profile to support.
- In theCertificate enrollmentsection, selectAllow optional certificate enrollmentif you want to allow users to dismiss certificate enrollment and complete it later.This is forAndroiddevices only.
- To specify which certificate theBlackBerry Dynamicsapp will use, perform the following actions:
- BesideIssuers, click and type the issuer name.BlackBerry Dynamicsapps will only use a certificate if the specified issuer matches theOpenSSLshort-form OID in the certificate. You can copy this value from the issuer's certificate. Do not put spaces before or after equal sign (=). For example:CN=Acme_cert SMIME,OU=Acme_Legal,O=Acme,C=Can CN=Acme_cert SMIME,OU=Acme_Legal,O=Acme CN=Acme_cert TLS
- In theKey usagesection, select the operations that the certificate supports.BlackBerry Dynamicsapps will only use certificates that have at least the specified key usage value set. For example, an encryption certificate may have a key usage value ofKey encipherment. An authentication certificate may have a key usage value ofDigital signature. A signing certificate may have a key usage value of bothDigital signatureandNonrepudiation.
- In theExtended key usagesection, select the functions that the certificate was issued for.BlackBerry Dynamicsapps will only use certificates if all selected extended key usage values are present in the certificate. Certificates can have additional extended key usage values.
- If the certificate was issued for purposes other than email, client authentication, or smart card login, selectAdditional Object ID usage, click and specify the OID for the key usage. For example, if the certificate will be used for server authentication, it may have the OID 220.127.116.11.18.104.22.168.1
- If you want the device to delete expired certificates, selectDelete expired certificates.Expired encryption certificates used for S/MIME should be retained on the device to allow users to read messages that were encrypted before the certificate expired.
- If you want the device to delete duplicate certificates, selectRemove duplicate certificates. The device deletes the certificate that has the earliest start date.
- Assign the profile to user accounts and user groups.