https://live.paloaltonetworks.com/t5/general-topics/is-it-possible-to-distribute-client-certificates-to-ios-devices/m-p/1252220#M126288 <P>&nbsp;</P> <DIV> <P>I would like to ask whether it is possible to <STRONG>distribute a client certificate to an iOS device at the time of GlobalProtect authentication by using SCEP</STRONG>, without relying on any MDM solution.</P> <P>My goal is to enable <STRONG>client certificate–based distribution and authentication for GlobalProtect on iOS</STRONG>, and I am currently exploring approaches that do <STRONG>not</STRONG> require MDM (such as Intune or Jamf).</P> <P>I am referring to the following documentation:</P> <UL> <LI><STRONG>Deploy User-Specific Client Certificates for Authentication</STRONG><BR /><A href="https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-user-authentication/set-up-client-certificate-authentication/deploy-user-specific-client-certificates-for-authentication---" target="_blank">https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-user-authentication/set-up-client-certificate-authentication/deploy-user-specific-client-certificates-for-authentication---</A></LI> </UL> <P>Based on this, I would like to confirm the following:</P> <UL> <LI>Can GlobalProtect use SCEP to <STRONG>distribute (or provision) a client certificate to an iOS device during GlobalProtect authentication</STRONG>?</LI> <LI>Is it technically possible for an iOS device to <STRONG>receive and store a client certificate via GlobalProtect SCEP without using MDM</STRONG>?</LI> </UL> </DIV> Wed, 15 Apr 2026 10:05:56 GMT TechNardi 2026-04-15T10:05:56Z https://live.paloaltonetworks.com/t5/general-topics/is-it-possible-to-distribute-client-certificates-to-ios-devices/m-p/1252220#M126288 <P>&nbsp;</P> <DIV> <P>I would like to ask whether it is possible to <STRONG>distribute a client certificate to an iOS device at the time of GlobalProtect authentication by using SCEP</STRONG>, without relying on any MDM solution.</P> <P>My goal is to enable <STRONG>client certificate–based distribution and authentication for GlobalProtect on iOS</STRONG>, and I am currently exploring approaches that do <STRONG>not</STRONG> require MDM (such as Intune or Jamf).</P> <P>I am referring to the following documentation:</P> <UL> <LI><STRONG>Deploy User-Specific Client Certificates for Authentication</STRONG><BR /><A href="https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-user-authentication/set-up-client-certificate-authentication/deploy-user-specific-client-certificates-for-authentication---" target="_blank">https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-user-authentication/set-up-client-certificate-authentication/deploy-user-specific-client-certificates-for-authentication---</A></LI> </UL> <P>Based on this, I would like to confirm the following:</P> <UL> <LI>Can GlobalProtect use SCEP to <STRONG>distribute (or provision) a client certificate to an iOS device during GlobalProtect authentication</STRONG>?</LI> <LI>Is it technically possible for an iOS device to <STRONG>receive and store a client certificate via GlobalProtect SCEP without using MDM</STRONG>?</LI> </UL> </DIV> Wed, 15 Apr 2026 10:05:56 GMT https://live.paloaltonetworks.com/t5/general-topics/is-it-possible-to-distribute-client-certificates-to-ios-devices/m-p/1252220#M126288 TechNardi 2026-04-15T10:05:56Z https://live.paloaltonetworks.com/t5/general-topics/is-it-possible-to-distribute-client-certificates-to-ios-devices/m-p/1252244#M126291 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/819566489">@TechNardi</a>&nbsp;-- We have iPads with GP installed on them with cert auth included as a part of the auth process and it's been our experience it's not possible.&nbsp; It's an iOS(ism), how Apple is designed.&nbsp; GP can't make device level changes like that.&nbsp; Installing certs need to come through the managed OS like the JAMF tool.</P> Wed, 15 Apr 2026 19:00:20 GMT https://live.paloaltonetworks.com/t5/general-topics/is-it-possible-to-distribute-client-certificates-to-ios-devices/m-p/1252244#M126291 Brandon_Wertz 2026-04-15T19:00:20Z