Verify certificate deployments

After you configure your Certificate Authority (CA) and deploy the certificates, verify that the certificates are present on your user's desktop devices.

If you can't verify that a certificate is deployed with the required settings, review the task steps. Ensure that you selected Device Access in the Okta Admin Console and that the certificates are set at Computer Level in your MDM.

The object identifier (OID) extension settings only apply if you use your own CA. If you use Okta as your CA, you don't need to verify them.

macOS

  1. On the macOS device managed by an MDM, open System Preferences > Profiles.

  2. Click Keychain and then click System.

  3. Confirm that the client certificate and the associated private key exist.

  4. If you use your own CA, verify that a custom extension is present on the client certificate. The OID 1.3.6.1.4.1.51150.13.1 must have the integer value 1.

Windows

  1. Click Start, and then enter certlm.msc.

  2. Click Manage computer certificates.

  3. Under Certificates - Local Computer, click Personal > Certificates.

  4. Make sure that the client certificate exists.

  5. If you use your own CA, verify the following:

    • If you use a CA other than Active Directory Certificate Services (AD CS), a custom extension is present on the client certificate. The OID 1.3.6.1.4.1.51150.13.1 must have the integer value 1.

    • If you use AD CS, the OID 1.3.6.1.4.1.51150.13.1.1 is listed in the enhanced key usage (EKU) extension.