Set up Device Trust with Jamf Pro on macOS

Complete the Jamf Pro setup before deploying these profiles.

Deploy all macOS certificate and VPN profiles through the Device channel, not the User channel. For custom profiles, set PayloadScope to System. Firezone needs the identity in the system Keychain.

Use the shared certificate values for the subject, both URI SANs, key usage, and CA template. Deploy the public CA chain as described in the provider setup before issuing the identity.

Deploy the profiles

The certificate identity and Firezone VPN payload must be in the same configuration profile. The VPN payload's PayloadCertificateUUID must exactly match the identity payload's PayloadUUID.

Configure an external SCEP CA for Jamf Pro. You can use the Jamf SCEP Proxy when the CA should not be reachable directly from managed devices.
Create an unsigned .mobileconfig containing an SCEP payload and a Custom VPN payload. You can use a profile editor to create the file. Use payload types com.apple.security.scep and com.apple.vpn.managed, respectively.
Enter the SCEP URL, CA name, and challenge. Keep the subject CN=dev.firezone.device-trust.

Add these two URI SAN entries:

firezone://jamf-id/$JSSID
firezone://serial/$SERIALNUMBER

Set the SCEP key type to RSA, key size to 2048 or 4096, and Key Usage to Signing. Ensure the CA template includes Client Authentication.
Set AllowAllAppsAccess=true and KeyIsExtractable=false in the SCEP payload.
Add accountSlug and any other managed configuration values to the VPN payload's VendorConfig dictionary.

Configure the VPN payload with these values:

Setting	Value
Connection name	`Firezone`
Connection type	Custom VPN (`VPNType=VPN`)
VPN identifier (`VPNSubType`)	`dev.firezone.firezone`
Server address (`VPN.RemoteAddress`)	`127.0.0.1`
Authentication (`VPN.AuthenticationMethod`)	`Certificate`
Identity (`VPN.PayloadCertificateUUID`)	The SCEP payload's `PayloadUUID`

Generate new payload UUIDs and set VPN.PayloadCertificateUUID to the SCEP payload's PayloadUUID.
In Jamf Pro, create a computer configuration profile and upload the completed, unsigned .mobileconfig.
Scope the profile to test devices. Confirm that Jamf substituted both SAN variables and installed both payloads, then connect Firezone.

In the SCEP payload's SubjectAltName dictionary, use an array for uniformResourceIdentifier to include both URIs.

Jamf documents its variables in Payload Variables for Configuration Profiles.

Do not sign the profile before uploading it. Jamf Pro cannot replace payload variables in a signed profile. Inspect the installed certificate on a test device and confirm that both URI SANs contain the device’s real inventory ID and serial number.

Jamf Pro's built-in enrollment certificates are for Jamf management. Use your SCEP or enterprise CA to issue the separate Firezone Client identity.

macOS private-key access

The Firezone system extension cannot display a Keychain authorization prompt. If the certificate is installed but signing fails, confirm that AllowAllAppsAccess=true was present when the key was issued. Reissue the identity if it was not.

Settings supplied through a managed policy, including accountSlug, become read-only in the Firezone Client. Users cannot change those values while the policy is applied.

Verify access and renewal

In Firezone, open Settings → Device Trust and confirm that the managed identity is selected.
Connect and open a Resource protected by Require attestation.
Renew the certificate through Jamf while preserving both device claims and the VPN payload's certificate reference.
Reconnect and repeat the access test before expanding the profile's scope.

Need help? See all support options.