How to Check If Device Trust Client Certificate Matches the One on User's Keychain (macOS)
Dec 5, 2025
Devices and Mobility
Overview
This article explains how to verify that the Device Trust client certificate matches the one stored on the user's local macOS machine. Since there is no Event info showing the expiration date in Okta System Logs, verify if the client certificate matches the one on the user's local machine.
Applies To
- Device Trust
- Okta Classic Engine
- macOS
Solution
-
Log in to Okta Admin Console.
-
Search for the user's certificate profile.
-
For example: [User's name + certificate]
-
-
With Targets showing: CN: "CN=Okta MTLS, O=Username CompanyName............"
Click the Event Info with "Authentication of device via certificate success" and click Expand All.
-
Compare the Client Certificate (Key ID) vs Okta System Logs: Scroll all the way down to Target > ID.
