SCEP Profiles Not Pushed to macOS via JAMF if Expired and Certificate Name Exceeds 65 Characters
Apr 22, 2025
Okta Classic Engine
Devices and Mobility
Okta Identity Engine
Overview
When deploying the Okta certificate to macOS devices through JAMF, it might be necessary to configure JAMF with a SCEP profile expiration that re-issues the SCEP profile after a specific number of days. This will silently fail if the certificate/subject name exceeds 64 characters.
Applies To
- Managed Devices
- JAMF
- Certificate deployment/renewal
Cause
This is an Active Directory limitation where Common Names must not exceed 64 characters, which prevents the SCEP profile distribution.
Solution
Update the certificate/subject name so that it is under 64 characters.
