Configure device trust with Iru (Kandji)
Iru, formerly Kandji, can substitute its device inventory ID into a certificate profile for Windows, macOS, iOS, and iPadOS devices.
Before you begin
Complete Set up Device Trust first, including adding
your issuing CA chain to Settings → Trust Anchors in Firezone.
You need an enrolled test device, Firezone installed, and a CA that can issue device certificates with the values below. Obtain the SCEP URL, CA name, enrollment challenge, and public root and intermediate CA certificates from your PKI administrator. Configure Client Authentication in the CA template as well as in the profile wherever that option is available.
Device identity certificate values
These are the shared requirements for the platform guides below. Include both the inventory ID and hardware serial as separate URI SAN entries in the same certificate; keep the subject common name fixed.
| Setting | Value |
|---|---|
| Subject name | CN=dev.firezone.device-trust |
| SAN type | Uniform Resource Identifier (URI) |
| SAN value: inventory ID | firezone://kandji-id/$DEVICE_ID |
| SAN value: serial number | firezone://serial/$SERIAL_NUMBER |
| Extended Key Usage | TLS Web Client Authentication (1.3.6.1.5.5.7.3.2) |
| Key Usage | Digital signature (Signing) |
| Key algorithm | RSA, 2048 or 4096 bits for these SCEP profiles |
| Private key | Non-exportable and hardware-backed where supported |
| Validity | Renew before expiry while preserving both device identifiers |
The CA must issue the requested SANs with actual device values. Check the issued certificate, not just the profile configuration. The full certificate requirements also apply when using a provisioning method other than SCEP.
Iru's global variables
supply $DEVICE_ID and $SERIAL_NUMBER. Firezone still uses kandji-id
for the Iru inventory claim.
Provision the CA chain
Create Certificate Library Items for your public root and intermediate CA certificates and assign them to the same Blueprint as the identity and Firezone app. On Windows, use the local computer's root and intermediate CA stores respectively. On macOS, use the Device channel.
The SCEP Library Item supports static challenges. The Apple guides use a custom profile to keep the certificate and VPN payloads together.
Choose your platform
Iru manages Android as well as Apple and Windows devices, but its SCEP and Certificate Library Items currently document support for Apple and Windows only. Android management alone does not provision a Firezone identity; use the universal setup with a certificate provisioning method that supports Android and grants Firezone access to the key.
On personally owned Android work profiles, omit the serial-number SAN and use a supported inventory ID. Android 12 and later restrict access to hardware serial numbers on these devices.
For Linux, use the universal PKCS#11 setup. Iru's management of other Apple device families does not imply Firezone Client support for those platforms.
Need help? See all support options.