Configure device trust with Jamf Pro
Jamf Pro can substitute its inventory ID into an Apple configuration profile.
Before you begin
Complete Set up Device Trust first, including adding
your issuing CA chain to Settings → Trust Anchors in Firezone.
You need an enrolled test device, Firezone installed, and a CA that can issue device certificates with the values below. Obtain the SCEP URL, CA name, enrollment challenge, and public root and intermediate CA certificates from your PKI administrator. Configure Client Authentication in the CA template as well as in the profile wherever that option is available.
Device identity certificate values
These are the shared requirements for the platform guides below. Include both the inventory ID and hardware serial as separate URI SAN entries in the same certificate; keep the subject common name fixed.
| Setting | Value |
|---|---|
| Subject name | CN=dev.firezone.device-trust |
| SAN type | Uniform Resource Identifier (URI) |
| SAN value: inventory ID | firezone://jamf-id/$JSSID |
| SAN value: serial number | firezone://serial/$SERIALNUMBER |
| Extended Key Usage | TLS Web Client Authentication (1.3.6.1.5.5.7.3.2) |
| Key Usage | Digital signature (Signing) |
| Key algorithm | RSA, 2048 or 4096 bits for these SCEP profiles |
| Private key | Non-exportable and hardware-backed where supported |
| Validity | Renew before expiry while preserving both device identifiers |
The CA must issue the requested SANs with actual device values. Check the issued certificate, not just the profile configuration. The full certificate requirements also apply when using a provisioning method other than SCEP.
Jamf documents these case-sensitive variables for both macOS and iOS/iPadOS.
Provision the CA chain
Deploy your public root and intermediate CA certificates in a certificate configuration profile scoped to the same devices as Firezone. Use the computer level on macOS and a device-level profile on iOS/iPadOS. Add the same CA chain to Firezone's trust anchors.
These guides use an external SCEP CA. If needed, configure Jamf Pro as a SCEP proxy. Other certificate provisioning methods can work too, provided the resulting identity meets the table above and is linked to the Firezone VPN payload.
Choose your platform
These guides cover the Firezone Client platforms managed by Jamf Pro: macOS, iOS, and iPadOS. Jamf Pro manages other Apple device families, but that does not imply Firezone Client support. For Windows, Android, or Linux, use another provider or the universal setup.
Need help? See all support options.