Trusted certificates
Upload trusted CA certificates so EntryPoint can validate the client certificates presented in EAP-TLS authentication.
EntryPoint’s EAP-TLS support validates client certificates — it does not issue them. Before any EAP-TLS authentication can succeed, you need to tell EntryPoint which CA certificates it should trust.
Certificate management lives on the Context’s Configuration tabs, on pages that appear once EAP-TLS is enabled in the Client Authentication Methods card.
EntryPoint is not a CA
Section titled “EntryPoint is not a CA”The admin UI does not let you generate or sign certificates inside EntryPoint. The flow is always:
- You (or your corporate PKI, or MDM provider) issue the client certificates.
- You upload the CA chain to EntryPoint on this page.
- EntryPoint validates the chain on every EAP-TLS attempt.
No SCEP integration is available inside the platform today; if you run SCEP it lives in your own PKI infrastructure, and EntryPoint only sees the final signed certificate on authentication.
Upload trusted CAs
Section titled “Upload trusted CAs”Open the Context and go to the relevant TLS configuration card:
- For EAP-TLS with User Certificate — follows from enabling EAP-TLS at Context level.
- For EAP-TLS with Device Certificate — the same trusted-CA list, plus a per-Group Certificate Group Identifier to map one CA to multiple Groups.
Click Add Trusted CA and upload the CA certificate (PEM). Add every level of the chain you need (root + any intermediates).
Certificate revocation (CRL)
Section titled “Certificate revocation (CRL)”Configure a CRL URL for the context so EntryPoint can check whether a presented certificate has been revoked. The same CRL URL covers every trusted CA in the list. Without a CRL, revoking a certificate in your corporate PKI has no effect on EntryPoint’s validation.
Day-to-day operations
Section titled “Day-to-day operations”- Issuing a new cert → done outside EntryPoint, in your PKI / MDM. Just make sure it’s signed by a CA in the trusted list.
- Revoking a cert → revoke at the CA, ensure the CRL is refreshed, and optionally remove the Self-Service User or the MAC from the Group to block the device immediately rather than waiting for CRL refresh.
- CA rotation → upload the new CA, leave the old one in place until no cert chained to it is still in use, then remove the old CA.
What lives in the Group vs the Context
Section titled “What lives in the Group vs the Context”- Context level (this page) — the trusted-CA list and the CRL URL.
- Group level — Certificate Group Identifier. EntryPoint matches the identifier against an attribute in the client certificate (for example, an OU in the subject DN) to decide which Group the device belongs to. See Device certificates and Intune.