Single Certificate Issuer

In preview orgs, a Single Certificate Issuer is a certificate authority (CA) that you configure once and trust for multiple purposes: device registration (for Okta Device Access and Okta Verify Sensor Mode), device access, and management attestation.

Previously, you had to configure a separate CA, or a separate configuration of the same CA, for each purpose. With a Single Certificate Issuer, you upload or generate a CA once and then choose which purposes trust it.

Device management settings are organized into four tabs:

• Certificate configuration: Generate a SCEP configuration that uses Okta as the CA.

• Certificate authority: Upload and manage your own (third-party) certificate authorities.

• Management attestation: Choose which certificate authorities and app hints are trusted to attest that desktop and mobile devices are managed.

• Device registration: Choose which certificate authorities are trusted when Okta verifies a device during registration.

When you generate a SCEP configuration on the Certificate configuration tab or upload your own CA on the Certificate authority tab, you're prompted to trust it for management attestation and, if applicable, for device registration. You can also change these trust settings later on the Management attestation or Device registration tab.

Only a CA that's trusted for device access can also be trusted for device registration. A CA that's trusted only for management attestation can't be used for device registration.

A Single Certificate Issuer reduces the number of certificate authorities and SCEP configurations that you need to create and maintain, because you can reuse one CA across device registration, device access, and management attestation instead of configuring each purpose separately.