Jamf Configuration Profiles Stuck Pending with System Log Error "Issue client certificatefailure: Error while issuing a ClientCertificate via SCEP: Subject CN cannot be null"
Dec 8, 2025
Devices and Mobility
Overview
In the following document, Configure Okta as a CA with dynamic SCEP challenge for macOS using Jamf Pro/Task 2: Create a dynamic SCEP profile in Jamf Pro, Jamf Configuration Profiles get Stuck Pending with concurrent system log error:
Issue client certificate failure: Error while issuing a ClientCertificate via SCEP: Subject CN cannot be null
Applies To
- Okta Identity Engine
- Device Trust
- JAMF
Cause
The "Subject:" on the SCEP profile page in Jamf is empty or does not begin with CN =
Solution
A suggested entry for the Subject: field of the profile would be:
CN = {EmailUserName} managementAttestation {DeviceUid}
This was previously suggested in: What certificate properties do I need when I create a SCEP profile in my MDM software?
