EJBCA

Workspace ONE UEM is flexible with PKI integration by being able to request certificates from either internal or external certificate authorities (CA). This article explains how to integrate with Enterprise Java Beans Certificate Authority (EJBCA) services to issue certificates for your Workspace ONE UEM MDM solution.

Important: If you select Key Recoverable as part of an EJBCA-backed certificate configuration, then this defaults to the certificate private key generation taking place in the CA instead of within Workspace ONE UEM. In this scenario, it is important to understand your certificate renewal frequency to ensure the number of certificates that are renewed daily can be supported by the CA infrastructure. Properly scaling the CA infrastructure and the certificate renewal period will keep daily certificate requests from exceeding your CA’s capacity.

Integrating with EJBCA

To have Workspace ONE UEM communicate with EJBCA for certificate distribution, you must have an EJBCA instance configured and ready to issue certificates. Then, configure Workspace ONE UEM to communicate with EJBCA using certificate-based authentication. Once communication is successfully established, define how to deploy certificates to devices. Below are some of the examples of how EJBCA and Workspace ONE UEM can be configured.

• Scenario 1: Workspace ONE UEM SaaS with EJBCA installed on-premises.
  
  1. Device enrolls with Workspace ONE UEM.
  2. Workspace ONE UEM requests a certificate from the EJBCA endpoint (optionally through the AirWatch Cloud Connector).
  3. The EJBCA endpoint delivers the certificate to Workspace ONE UEM (optionally through the AirWatch Cloud Connector).
  4. Workspace ONE UEM delivers the certificate to the device as part of an EAS, VPN, or WiFi profile.

If your EJBCA endpoint is public-facing, then it must be protected by a public SSL certificate. If you are using AirWatch Cloud Connector, then it needs to be configured to trust the root certificate installed on your EJBCA appliance.

• Scenario 2: Workspace ONE UEM and EJBCA both installed on-premises.
  
  1. Device enrolls with Workspace ONE UEM.
  2. Workspace ONE UEM requests a certificate from the EJBCA endpoint (optionally through the AirWatch Cloud Connector).
  3. The EJBCA endpoint delivers the certificate to Workspace ONE UEM (optionally through the AirWatch Cloud Connector).
  4. Workspace ONE UEM delivers the certificate to the device as part of an EAS, VPN, or WiFi profile.

If your EJBCA endpoint is public-facing, then it must be protected by a public SSL certificate. If you are using AirWatch Cloud Connector, then it needs to be configured to trust the root certificate installed on your EJBCA appliance. See Configuring AirWatch Cloud Connector to trust EJBCA for more information.

Prerequisites

• An EJBCA instance is configured and ready for certificate deployment.
• The EJBCA Web Services (WS) interface is enabled on your EJBCA server. The WS interface is not enabled by default on EJBCA and must be turned on before Workspace ONE UEM can communicate with the EJBCA endpoint. For information on enabling the Web Services interface, see the EJBCA Web Service Interface documentation.
• Workspace ONE UEM console version 2310 or later is installed.
• If your EJBCA appliance is public-facing, it is protected with a public SSL certificate.
• If you are using the AirWatch Cloud Connector (ACC) for enterprise integration, ACC is configured to trust the root certificate installed on your EJBCA appliance.
• If this integration is facilitated through the ACC, Microsoft Certificate Services must be activated under Groups & Settings > All Settings > System > Enterprise Integration > Cloud Connector > Advanced. If Microsoft Certificate Services is not activated, the EJBCA integration does not function.
• The EJBCA Web Services role used for the integration is explicitly authorized against the specific End Entity Profile, Certificate Profile, and CA combination that you intend to use. If the WS role lacks the correct authorization scope, certificate issuance will fail even when CA connectivity appears healthy. Confirm this authorization in the EJBCA administration console before proceeding.

Procedure

Configure the CA entry, the request template, and then the device profile in the Workspace ONE UEM console.

Step 1: Configure the Certificate Authority

1. Navigate to Devices > Certificates > Certificate Authorities.
2. Click Add and complete the following fields.

3. Click Save.

Step 2: Configure the Request Template

After saving the CA entry, configure a request template that specifies how Workspace ONE UEM constructs certificate requests for this CA.

1. Navigate to Devices > Certificates > Request Templates.
2. Click Add and complete the template fields, selecting the EJBCA CA entry you created in Step 1.
3. Click Save.

Step 3: Configure Workspace ONE UEM Profiles (Payloads)

After creating the CA entry and request template, configure a device profile that uses the EJBCA certificate. After you create the profile, you can add additional payloads that use the certificate, such as Exchange ActiveSync (EAS), VPN, or Wi-Fi.

1. Navigate to Devices > Profiles > List View.
2. Click Add.
3. Select the applicable platform for the device type.
4. Specify all General profile parameters.
5. Select Credentials from the payload options and click Configure.
6. Select Defined Certificate Authority from the Credential Source drop-down menu.
7. Select the external EJBCA certificate you created in Step 1.
8. Select the EJBCA request template you created in Step 2.
9. If you plan to use the certificate for Wi-Fi, VPN, or email, configure the respective payload in the same profile.
10. Click Save and Publish to deploy the certificate to devices.

Optional: Configure the AirWatch Cloud Connector to Trust EJBCA

If you are using ACC and the EJBCA appliance is not public-facing, ensure that the ACC configuration trusts the appliance.

1. Open the EJBCA console certificate and view the Certificate Path tab.
2. If multiple certificates are listed, separate them and add each to the appropriate certificate store.
3. Add the root certificate to the Trust Root Store using the Certificate Import Wizard:
   1. Proceed through the Certificate Import Wizard when prompted.
   2. Select Browse and locate the root certificate file used to generate the EJBCA console certificate.
   3. Select Next and complete the wizard.

Integration Tips and Troubleshooting

Verify certificate authentication outside of Workspace ONE UEM

To ensure that the issue isn't related to Workspace ONE UEM, it's important to test certificate authentication independently.

Before troubleshooting within Workspace ONE UEM, remove Workspace ONE UEM from the configuration and manually configure a device to connect to your network server using certificate authentication. Certificate authentication must work independently of Workspace ONE UEM before the integration can function correctly.

Verify certificate authentication with Workspace ONE UEM

To ensure that certificate authentication is working correctly with Workspace ONE UEM, push a profile to the device and test whether the device can connect and sync to the configured EAS, VPN, or Wi-Fi access point. If the device doesn't connect and displays a message that the certificate cannot be authenticated or the account cannot connect, review the configuration using the checks below.

SSL/TLS errors are received while creating a template

This error can occur when you attempt either of the following tasks:

• Create a Workspace ONE UEM certificate template by selecting the Retrieve Profiles button.
• Retrieve a certificate from the Workspace ONE UEM console.

Workspace ONE UEM certificate profile fails to install on the device

Contact Workspace ONE UEM Professional Services and request the following:

• Enable Verbose Mode to capture additional diagnostic data. For information about enabling Verbose Mode, see Integrated Services Logging

• Retrieve the web console log.

Certificate is not populated in the View XML option of the profile

If you're facing issues where the certificate is not appearing in the View XML option of the profile, follow these steps to troubleshoot:

• Confirm that the lookup values configured on the EJBCA certificate profile match the lookup values in the Workspace ONE UEM console request template.
• Confirm that the lookup values in the Workspace ONE UEM request template are populated in the user information that is pulled from Active Directory.
• Confirm that you are pointing to the correct profile in EJBCA.

Certificate issuance fails, but CA connectivity shows as healthy

If Workspace ONE UEM reports that the CA connection is successful but certificates are not being issued, verify that the EJBCA Web Services role used for the integration is authorized against the specific End Entity Profile, Certificate Profile, and CA combination you are using. Insufficient WS role authorization is a known cause of issuance failures that do not produce a clear connectivity error.

Integration fails when facilitated through the AirWatch Cloud Connector

If the EJBCA integration is facilitated through the AirWatch Cloud Connector (ACC) and the integration is not functioning, confirm that Microsoft Certificate Services is activated under Groups & Settings > All Settings > System > Enterprise Integration > Cloud Connector > Advanced. When Microsoft Certificate Services is not activated, the EJBCA integration will not work through ACC, even though other ACC-facilitated services may appear healthy.