Blackberry PRD-10459-003 Administration Guide - Page 187

Administration Guide Configuring BlackBerry devices to enroll certificates over the wireless network Configuring BlackBerry devices to enroll 16 certificates over the wireless network You can configure the BlackBerry® Enterprise Serverto permit BlackBerry devices to enroll certificates that the devices can use with any PKI-enabled application or process. You can permit devices to enroll the certificates instead of instructing users to send the certificates to themselves in an email message or use the certificate synchronization tool in the BlackBerry® Desktop Software. When you configure the BlackBerry Enterprise Server to permit devices to enroll certificates, you can control how users request certificates and which certification authority issues the certificates. For example, you might want Wi-Fi® enabled BlackBerry devices to enroll certificates so that they can authenticate to an enterprise Wi-Fi network. You can enroll certificates from one of the following certification authorities: • RSA® certification authority • Microsoft® standalone certification authority • Microsoft enterprise certification authority During the enrollment process, the BlackBerry MDS Connection Service can verify the certificate if the certificate includes an email address in the subject DN. The BlackBerry MDS Connection Service verifies the certificate by checking if the email address in the subject DN of the certificate matches the email address that is assigned to the device. For more information about the enrollment process, see the BlackBerry Enterprise Solution Security Technical Overview. You can make the certificate enrollment process required so that devices automatically start the certificate enrollment process after the devices receive the updated IT policy from the BlackBerry Enterprise Server. If you do not make the certificate enrollment process required, you must instruct users to start the CA Profile Manager on the devices manually. Configure the certificate information using IT policies You must configure the certificate information that BlackBerry® devices can use to create certificate requests so that the certificate enrollment process can occur. If you configured the BlackBerry MDS Connection Service to retrieve the status of the certificates using an OCSP server or a CRL server and pull authorization is turned on, devices may not be able to enroll some certificates over the mobile network. The devices might not be able to enroll some certificates because, devices that initiate the request to the web addresses follow pull authorization rules that restrict access to some of the web addresses for OCSP servers and CRL servers. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Policy. 2. Click Manage IT policies. 3. Click an IT policy. 4. Click Edit IT policy. 185