Why digital certificates are essential for managing mobile devices

Why digital certificates are
essential for managing mobile devices
Who should read this paper
This white paper explores the authentication security needs of enterprises struggling to manage their rapidly evolving
mobile workforce. Through a detailed discussion and examination of use cases, digital certificates emerge as anenterprise’s premier security credential for the wide variety of mobile devices available today. This includes a casewhere a mobile device management solution is deployed and the DigiCert PKI Platform emerges as the best-in-classsolution for managing digital certificates.

Why digital certificates are essential for managing mobile devices

Table of contents
1

Introduction

1

Managing and trusting a mobile environment

1

Trusted mobile access2

Why digital certificates3Enterprise certificate management

5

DigiCert PKI Platform simplifies management and lowers cost

6

Using DigiCert PKI Platform simplifies managing certificates8

Summary

9

Glossary

Why digital certificates are essential for managing mobile devices

Introduction
There is no question that mobile devices have become
an integral part of the corporate IT tool set. As theform factors and functional options of smartphones,
tablet computers, and other mobile devices continue
to expand, many organizations are replacing desktop
and laptop PCs with these popular and easy-to-use
devices. Unfortunately, the pace of change is so rapid
it makes the environment difficult for enterprise IT
to manage and is ripe for attackers hoping to exploit
security vulnerabilities, steal personal information, andimpersonate unknowing victims.
Now that the enterprise is no longer limited to desktop
machines confined within the corporate firewall, it isimperative that the enterprise can trust the data andapplications on their mobile user devices as well as theend user to whom a device belongs.

Managing andtrusting a mobile
environment
During the reign of the corporate desktop, IT had
defined standard hardware and software configurations
to simplify support, lower maintenance costs, andmaintain a common platform for combating security
threats. Over time, various enterprise software
management tools have become the status quo for
centrally and remotely managing all the software,settings, and security policies on these systems.
Not surprisingly, IT is looking for similar functionality
for mobile devices, to control device configuration,

distribute and monitor client-side software, mitigate
vulnerabilities, and control data risk. In fact, IT requires
more than just the functionality traditionally reserved
for the desktop, since mobile devices can be easily
lost or stolen and are not protected by the physicalperimeters of the enterprise.
To tackle this, a variety of software, services, andspecialized Mobile Device Management (MDM)
platforms have emerged to to remotely provision
devices, track inventory, manage applications andenforce policy on the mobile device; including a way foran enterprise to remotely wipe or disable a device in thefield. Only by managing the mobile device as closely
as a desktop can the enterprise trust the device as anextension of its network.

Trustedmobile access
Management capabilities by themselves don’tnecessarily result in great security—without good
authentication a secure mobile device ecosystem isincomplete. Most security professionals agree that username and password access is not a sufficiently strong
method of authentication for enterprise IT assets even
if an MDM is used. Security workarounds for password
weaknesses, such as requiring users to frequently
change their password, often backfire as users resort towriting their passwords down so that they canbe remembered.

Why digital certificates are essential for managing mobile devices

Best practice security requires IT management toprovide strong forms of security credentials so thatthe user of a device can be trusted on the enterprise’s
network and with enterprise applications. Stronger
security credentials not only verify the identity of theindividual, they validate the device and secure thetransportation of this information. These can takea number of forms, but the most widely accepted
credential that meets these requirements is adigital certificate.

Why digital
certificates

Figure 1: A digital certificate infrastructure can serve a
number of enterprise applications.
Digital certificates provide a far better user experienceon mobile devices compared to typing user name/password because of the limited keyboard space.
Finally, they are the ideal form of transparent
authentication. They do not require human intervention
to use (unless specifically configured to do so for
special applications); and they free up users from thetyranny of usernames and passwords that change
every 30, 60, or 90 days.

Digital Certificates are time tested, successfully
securing networks and data for nearly two decades.
Their basis in public key encryption technology makes
them an excellent choice for strong authentication—
significantly more secure than just passwords.
But it is their support for a broad range of security
requirements, not just authentication or encryption,that makes them so valuable. Digital certificates canbe used to protect websites, VPNs, wireless networks,
and other applications. It’s the flexibility of having one
credential that can support a variety of enterpriseauthentication security tasks that makes certificates so
widely accepted and used.

In addition, digital certificates are well supported byvirtually all enterprise MDM solutions. Although it istrue that it is not mandatory to use digital certificateswith MDM, it should be noted that without using a
digital certificate the communications to authenticate
a user and validate a device (for example, transportinga profile) would be done in an insecure manner.
Specifically, devices would have profiles, even if it were
simply a user name/password or a one-time password(OTP) that would not be bound to a single device,
allowing the profiles to be restored to other devices.
These profiles could contain cleartext credentials
that could be used to access enterprise resources.
Therefore, it is a best practice requirement to use
digital certificates with all MDMs to securely transport

Digital certificates are well supported by laptop, tablet,and mobile smartphone operating systems such as
Apple iOS®, Android, and others. Many, if not most,enterprise networking and software applications
support digital certificates. The predominant
applications using certificates on mobile devices
include, but are not limited to, those shown in thefollowing diagram.

2

Why digital certificates are essential for managing mobile devices

and protect profiles. As a statement to the importanceof digital certificates, the protocol to securely deliverprofiles as specified by Apple’s own documentation
requires the use of PKI (which utilizes
digital certificates).

Managing digital certificates, which are based on publickey cryptography, requires a Public Key Infrastructure(PKI). The main function of PKI is to distribute thecertificates (and the associated public keys) accurately
and reliably to users and devices, and to manage thecertificate lifecycle. In selecting a PKI to provide these
critical capabilities, organizations must choose between
deploying PKI software in-house or outsourcing PKI
services to a reliable provider. It should be noted that
all in-house projects, whether an MDM is used or not,will require custom enhancements to support the PKI
deployment to manage mobile devices.

The flexibility of a digital certificate to meet many
security needs is well documented. Savvy enterprises
can optimize their investment and gain efficiency
by leveraging their digital certificate authentication
credentials for their enterprise authentication security(for example, email, VPN, and WiFi), in addition to theirrequired use in the back-end MDM infrastructure.

The options listed below are some of the mostcommon customer choices:Enterprise certificate
management
While certificate support may be built into theapplications on the mobile device, IT needs an effective
way to manage the certificate lifecycle from theenterprise side. This includes getting the certificatessecurely onto the device as well as renewing them andrevoking them when necessary. The various processes
within the certificate management lifecycle areillustrated below.
Communicate
and enroll
Revoke,recover,
replace andreportIdentify,
authenticate
and confirm

Communicate
and renew

Deliver, installand configure

Open source software tools such as OpenCATM
or Enterprise Java Bean Certificate Authority(EJBCA) which are self-managed and supported
by enterprise IT staff•

Commercial software such as Microsoft
Active Directory® Certificate Services in which
rudimentary public key infrastructure tools
are included•

Turn-key, cloud-based public key infrastructure
solutions provided as a managed service such as
DigiCert PKI Platform

An enterprise must carefully decide which approach touse as the success of a PKI deployment in an enterpriseis dependent upon how easy it is to use and manage,and how seamless the user experience is. In addition,
the method must be able to scale to the needs of theenterprise as it expands its usage of these credentials
around the globe on a wide variety of applications
and devices.

Enable applicationsand validation

Figure 2: Management of certificate lifecycle processes
is critical.

•

3Why digital certificates are essential for managing mobile devices

The table below identifies the factors that should be considered when choosing a PKI solution that will meet theneeds and available resources of the organization.

Hosted PKI Platform(Managed PKI Service)

Off-the-Shelf or Commercial
PKI Software

PKI Functionality

Fully-featured PKI, with global root oftrust and validation service. A provensolution with years of operational
experience serving hundredsof enterprises.

Enterprise designs, builds, and deploys
supporting infrastructure, and assumes
100% of the implementation andoperational burden.

Simple to Deploy

Supports all popular enterprise webbrowsers, mail clients, enterprise
VPNs, and wireless networks. The
environment is largely pre-provisioned
for common applications and the portal
is highly templatized so it’s easy to
get started.

Frequently requires significate
customization and professional
services assistance. Cross-platform
support often limited or requires
proprietary client software.

Automation

Support for client automation protocols
such as iOS OTA and Microsoft AutoEnrollment make user and device
enrollment simple and transparent.
Certificates can be delivered to user
device without the need for
manual configuration.

Most on-premise PKI solutions havelittle or none of this functionaltiy. For
example, Microsoft Certificate Services
will only support direct issuance with
Windows Mobile devices.

Availability
and Scalability

Contractually guaranteed PKI backbone
services and disaster recovery. Highly
scalable. Leverages high-capacity, faulttolerant infrastructure.

Enterprise provides 100% of
infrastructure, redundancy, anddiaster recovery services. Enterprisemust manage its own availability andscalability requirements.

Security and
Risk Management

Mature, industry-leading key
management and certificate practices.
Externally audited operations and policy
certifications for U.S. DoD, Adobe CDS,
and more.

Enterprise provides 100% of security
infrastructure; must design its own
operational policies and practices;
assumes 100% of risk.

Success Factor

4Why digital certificates are essential for managing mobile devices

Hosted PKI Platform(Managed PKI Service)

Off-the-Shelf or Commercial
PKI Software

Personnel

DigiCert highly-trained security
professionals who undergo a rigorous
screening process. Their core focus
is security and PKI; they are highly
trained and possess up-to-the-minuteknowledge base and skill sets.

Personnel must be trained and skills
refreshed to keep up with the evolving
technology, standards and risk.
Inexperience or attrition may slow
deployment, cause downtime, andcreate gaps in security.

Scope of Operation

Full portfolio of public certificate
authorities (CAs), with online
enrollment, validation, and management
services. Enterprise can select private
and/or public trust networks (largest in
the world).

Enterprise builds 100% custom
solutions. Self-managed private systemwith self-signed certificates limits
trust to internal applications. Crosscertification and validation–private only.

Success Factor

DigiCert PKI
Platform simplifies
management andlowers cost

Because DigiCert PKI Platform is a cloud-based service,
the software and hardware infrastructure is hosted by
DigiCert and is included in the service contract. At thesame time, the cloud-based managed service model
reduces operating expenses by eliminating systemand software maintenance; and allows enterprises
to more easily deploy and support users, particularly
mobile users, who are often remote. Trying to duplicate
the global reach, High Availability (HA) and Disaster
Recovery (DR) of DigiCert PKI Platform would beprohibitively expensive for enterprises to implement on
their own. And for peace of mind, the managed service
account comes with a binding SLA ensuring 99.5
percent uptime.

DigiCert PKI Platform is an outsourced, managed
service offering that enables organizations of any
size to cost effectively deploy and manage certificate
lifecycle procedures for mobile devices and mobile
device management deployments. It scales as theorganization’s needs grow while alleviating the burdenof planning, building, and maintaining a certificate
management infrastructure. It provides a seamlessuser experience, while giving the administrator what’s
needed to maintain proper policy oversight, practices,and process. Using the DigiCert PKI Platform, anorganization can maintain best practice control overuser and device authentication security at lower costs,
with less time and resources, and better results thanwith other methods.

99.5%
For peace of mind, themanaged service accountcomes with a binding SLA
ensuring 99.5% uptime.

5Why digital certificates are essential for managing mobile devices

As a customer of DigiCert, an organization can leverage
all the knowledge, experience, and best practices
developed in over 15 years of successful operation asa world-wide leading, enterprise class service run by
security and data center experts. DigiCert operates
infrastructure that enables businesses and individuals
to find, connect, secure, and transact business acrosstoday’s complex global networks. As an industry leader
in internet security and Root Key Management, DigiCert
builds state-of-the-art integrated PKI service platforms
for enterprises of all sizes. Real-world experience serves
as the foundation for the design and supportreadinessof the DigiCert PKI Platform. By leveraging DigiCert’s
expertise and infrastructure, enterprises alleviate
the burden of building, deploying, and maintaining
an in-house infrastructure while retaining complete
control over certificate lifecycle management, including
issuance, renewal, and revocation.

Using DigiCert’s PKI
Platform simplifies
managing certificates
In addition to the cost saving of using the cloudbased DigiCert PKI Platform, there are three primary
operational advantages for using it to issue certificatesto mobile devices.
1. Integration with MDM solutions offer a variety
of deployment models - DigiCert PKI Platform
is tightly integrated with numerous MDM
solutions such as, MobileIron®, AirWatch®,
Fiberlink®, and Zenprise®; via a web- services
interface so that organizations have a variety of
deployment models from which they can choose
to support their various user populations.

2. Mobile-aware certificate service makes
managing certificates easy - DigiCert PKI
Platform provides a largely pre- provisioned
web-based environment for creating anenterprise’s certificate trust hierarchy, thecertificate formats required for their mobile
devices, and the operational services requiredfor ongoing user enrollment, certificate approval,
certificate validation, and otheroperational issues.
3. Direct integrations with a diverse set of mobile
platforms and applications - DigiCert PKI
Platform provides highly integrated capabilities on
key mobile client platforms such as iOS andAndroid. This offers customers the advantage
of automating client device and application
configurations even in situations where no MDM
is deployed.
The examples that follow illustrate how the mostcommon advantages are operationalized for various
mobile device use cases by showing how user
certificate enrollment, delivery, and installation is
simplified with DigiCert PKI Platform.

By leveraging DigiCert’s
expertise and infrastructure,enterprises alleviate
the burden of building,deploying, and maintaining
an in-house infrastructure
while retaining complete
control over certificate
lifecycle management,
including issuance, renewal,
and revocation.

Why digital certificates are essential for managing mobile devices

Operation with a Mobile Device
Management system (MDM)
In this model, the MDM acts as a broker between themobile device and the certificate service. The certificate
is treated as if it were an application or other piece of
secure data, which must be managed on the device
using the MDM. As the diagram below illustrates,
the MDM server enrolls for the certificates from thecertificate service and then installs these certificates,
and associated configurations, onto the mobile devices

The DigiCert PKI Platform provides a web services
interface that makes it easy for MDM solutions tointegrate with the DigiCert service. Many third parties
integrate in this way including the market leading
DigiCert Mobile Management solution. DigiCert PKI
Platform provides the Simple Certificate Enrollment
Protocol (SCEP) that is used to issue the device identity
certificate which lays the foundation for the secure
profile download from the MDM solution.

based on its own configurations.

Figure 3: Operation with a Mobile Device Management system (MDM)

Direct device support throughmobile-aware certificate service
This is a major benefit for the mobile device end user
and for the IT team that supports them in that it allows
the end user configuration to be fully automated andtransparent. For example, in Apple iOS, Symantec
Managed PKI Service leverages built-in iOS Over-the-Air(OTA) protocol capabilities, which allow the iOS device
or application to make certificate enrollment requests
via SCEP. The Platform then delivers an iOS OTA
configuration profile along with the certificate payload,so that the device is able to self-configure to use thecertificate for all the applications that will use it. The
figure below illustrates this process for an iOS device.

This model is good for enterprises who wish to havea simple and lightweight solution to deploy mobile
device management certificates onto mobile devices,and use them for other applications as well. In addition,
this model is important for simultaneously supporting
nonmobile users.
This direct device support allows the end user toenroll for a certificate directly on their mobile device,in the same way a user would enroll on their desktop
computer. The enrollment pages are formatted for theirmobile devices and the certificate service automaticallyconfigures both the certificate installation as well as theapplications that use it.

7Why digital certificates are essential for managing mobile devices

Another major advantage when using DigiCert PKI
Platform with iOS is that the service management
workflow allows the administrator to define the target
device OTA configuration management profile, atthe same time that the device certificate format andenrollment options are being defined – making theadministrator’s task much simpler.

For devices that don’t have an iOS OTA equivalent, suchas Android devices, Microsoft Windows® or Apple
Mac® tablets, DigiCert provides a Windows PKI clientthat similarly hides the complexity of configuring thedevice and application to use the certificate.

Figure 4: Direct device support through mobile-aware certificate service

Summary
Digital certificates provide unique advantages overother credential technologies such as passwords.
Just a single digital certificate can provide greater
functionality and access to many applications wheremultiple passwords of varying requirements may benecessary. Certificates are not only industry recognized
as the premier security credential; they are time tested
with decades of use and evolution. In addition to being
required to appropriately secure your Mobile Device
Management solution, certificates can be used for theinternal support of many applications onmobile devices.

mobile devices as well as a wide variety of partnerships
with major Mobile Device Management (MDM) partners
such as, MobileIron, AirWatch, Fiberlink, and Zenprise;
DigiCert PKI Platform provides an excellent solution for
managing content security on mobile devices. As thesedevices continue to evolve and mirror or even replace
the functionality on desktop computers, enterprises will
rely on DigiCert PKI Platform to provide the necessary
security credentials to guarantee these devices aretrusted, their data is protected, and the device is only
available to its rightful user.
Ask your sales representative about the DigiCert PKI
Platform and Mobile Device Management solutions orvisit www.digicert.com.

DigiCert PKI Platform provides the best-in-classsolution for protecting mobile devices using digital
certificate credentials. With both internal support for8Why digital certificates are essential for managing mobile devices

Glossary
Certificate Authority: A trusted party, authorized toissue, revoke, or suspend digital certificates as part of apublic key infrastructure (PKI)

Over-the-Air (OTA): This term refers to various
methods of distributing new software updates or
configuration settings to devices like cellphones. OTA
configuration has become increasingly important as
new updates and services come on stream.

Digital Certificate: A trusted and secure form of anelectronic signature, which provides verified user
identity, document integrity, time stamp, and nonrepudiation of signed electronic documents.

Public Key Infrastructure (PKI): A set of hardware,
software, people, policies, and procedures needed tocreate, manage, distribute, use, store, and revoke digital
certificates

Disaster Recovery: The process, policies, andprocedures related to preparing for recovery or
continuation of technology infrastructure critical to anorganization after a natural or human-induced disaster.

Simple Certificate Enrollment Protocol (SCEP): The
most popular certificate enrollment protocol; widely
available and most tested. It is designed to make theissuing and revocation of digital certificates as scalable
as possible.

Enterprise Java Bean Certificate Authority (EJBCA): A
free software PKI certificate authority software
package maintained and sponsored by a Swedish
forprofit company.
Mobile Device Management (MDM): Software that
secures, monitors, manages and supports mobile
devices deployed across mobile operators, service
providers, and enterprises. MDM functionality typically
includes over-the-air (OTA) distribution of applications,data and configuration settings for all types of mobile
devices, including mobile phones, smartphones, tablet
computers, ruggedized mobile computers, mobile
printers, mobile POS devices, etc.

9Why digital certificates are essential for managing mobile devices

About DigiCert
DigiCert, with the addition of Symantec’s Website Security business,
is a leading global provider of digital certificates. The world’s leadingbanks, e-commerce, technology, healthcare and manufacturing
companies rely on us to provide scalable encryption andauthentication for their most valuable online properties. Beyond theweb, DigiCert innovates with leading scalable, automated PKI-based
solutions for identity, authentication, and encryption for the Internet ofThings (IoT) and other emerging, connected markets.

For more information, contact a PKI expert
1.801.770.1736 or email pki_info@digicert.com.
© 2020 DigiCert, Inc. All rights reserved. DigiCert is a registered trademark of DigiCert, Inc. in
the USA and elsewhere. All other trademarks and registered trademarks are the property of theirrespective owners.