CertificateStore CSP

Article
01/31/2024

The CertificateStore configuration service provider is used to add secure socket layers (SSL), intermediate, and self-signed certificates.

Note

The CertificateStore configuration service provider does not support installing client certificates. The Microsoft protocol version of Open Mobile Alliance (OMA) is case insensitive.

For the CertificateStore CSP, you can't use the Replace command unless the node already exists.

The following list shows the CertificateStore configuration service provider nodes:

./Device/Vendor/MSFT/CertificateStore
- CA
  - {CertHash}
  - System
    - {CertHash}
- MY
  - SCEP
    - {UniqueID}
  - User
    - {CertHash}
  - WSTEP
    - CertThumprint
    - Renew
- ROOT
  - {CertHash}
  - System
    - {CertHash}

CA

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA

This cryptographic store contains intermediary certification authorities.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

CA/{CertHash}

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/{CertHash}

The SHA1 hash for the certificate. The 20-byte SHA1 hash of the certificate is specified in hexadecimal. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Delete, Get
Dynamic Node Naming	UniqueName: The SHA1 hash for the certificate.

CA/{CertHash}/EncodedCertificate

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/{CertHash}/EncodedCertificate

The base64 Encoded X.509 certificate.

Description framework properties:

Property name	Property value
Format	`b64`
Access Type	Add, Get, Replace

CA/{CertHash}/IssuedBy

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/{CertHash}/IssuedBy

The name of the certificate issuer. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

CA/{CertHash}/IssuedTo

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/{CertHash}/IssuedTo

The name of the certificate subject. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

CA/{CertHash}/TemplateName

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/{CertHash}/TemplateName

Returns the certificate template name.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

CA/{CertHash}/ValidFrom

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/{CertHash}/ValidFrom

The starting date of the certificate's validity. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

CA/{CertHash}/ValidTo

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/{CertHash}/ValidTo

The expiration date of the certificate. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

CA/System

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/System

This store holds the System portion of the CA store.

Note

Use RootCATrustedCertificates CSP moving forward for installing CA certificates.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

CA/System/{CertHash}

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/System/{CertHash}

The SHA1 hash for the certificate. The 20-byte SHA1 hash of the certificate is specified in hexadecimal. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Delete, Get
Dynamic Node Naming	UniqueName: The SHA1 hash for the certificate.

CA/System/{CertHash}/EncodedCertificate

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/System/{CertHash}/EncodedCertificate

The base64 Encoded X.509 certificate.

Description framework properties:

Property name	Property value
Format	`b64`
Access Type	Add, Get, Replace

CA/System/{CertHash}/IssuedBy

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/System/{CertHash}/IssuedBy

The name of the certificate issuer. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

CA/System/{CertHash}/IssuedTo

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/System/{CertHash}/IssuedTo

The name of the certificate subject. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

CA/System/{CertHash}/TemplateName

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/System/{CertHash}/TemplateName

Returns the certificate template name.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

CA/System/{CertHash}/ValidFrom

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/System/{CertHash}/ValidFrom

The starting date of the certificate's validity. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

CA/System/{CertHash}/ValidTo

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/CA/System/{CertHash}/ValidTo

The expiration date of the certificate. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

MY

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY

This store keeps all end-user personal certificates.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

MY/SCEP

Note

This policy is deprecated and may be removed in a future release.

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP

This store holds the SCEP portion of the MY store and handle operations related to SCEP certificate enrollment.

Note

Use ClientCertificateInstall CSP to install SCEP certificates moving forward.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

MY/SCEP/{UniqueID}

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}

The UniqueID for the SCEP enrollment request. Each client certificate should've different unique ID.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Add, Delete, Get

MY/SCEP/{UniqueID}/CertThumbPrint

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/CertThumbPrint

Specify the current cert's thumbprint.

20-byte value of the SHA1 certificate hash specified as a hexadecimal string value.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

MY/SCEP/{UniqueID}/ErrorCode

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/ErrorCode

Specify the last hresult in case enroll action failed.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Get

MY/SCEP/{UniqueID}/Install

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install

The group to represent the install request.

Note

Though the children nodes under Install support Replace commands, after the Exec command is sent to the device, the device takes the values that are set when the Exec command is accepted. You should not expect the node value change that occurs after the Exec command is accepted to impact the current undergoing enrollment. You should check the Status node value and make sure that the device is not at an unknown stage before changing the children node values.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

MY/SCEP/{UniqueID}/Install/CAThumbPrint

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/CAThumbPrint

Specify root CA thumbprint.

20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. When client authenticates the SCEP server, it checks CA certificate from SCEP server for a match with this certificate. If it doesn't match, the authentication fails.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/Challenge

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/Challenge

Enroll requester authentication shared secret.

The value must be base64 encoded. Challenge is deleted shortly after the Exec command is accepted.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/EKUMapping

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/EKUMapping

Specify extended key usages. The list of OIDs are separated by plus "+".

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/Enroll

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/Enroll

Start the cert enrollment.

The MDM server can later query the device to find out whether the new certificate is added. Value type is null, which means that this node doesn't contain a value.

Description framework properties:

Property name	Property value
Format	`null`
Access Type	Exec

MY/SCEP/{UniqueID}/Install/HashAlgrithm

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/HashAlgrithm

Client create Cert enroll request, get supported hash OIalgorithm from SCEP server and match it with one specified in this parameter.

Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by the MDM server. If multiple hash algorithm families are specified, they must be separated with +.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/KeyLength

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/KeyLength

Specify private key length (RSA).

Valid values are 1024, 2048, 4096. NGC key lengths supported should be specified.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/KeyProtection

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/KeyProtection

Specify where to keep the private key.

Although the private key is protected by TPM, it isn't protected with TPM PIN. SCEP enrolled certificate doesn't support TPM PIN protection. Supported values are one of the following values:

1: Private key is protected by device TPM.
2: Private key is protected by device TPM if the device supports TPM.
3 (default): Private key is only saved in the software KSP.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/KeyUsage

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/KeyUsage

Specify the key usage bits (0x80, 0x20, 0xA0) for the cert.

The value must be specified in decimal format and should at least have second (0x20) or fourth (0x80) or both bits set. If the value doesn't have those bits set, configuration will fail.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/RetryCount

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/RetryCount

When the SCEP sends pending status, specify device retry times.

Default value is 3. Max value can't be larger than 30. If it's larger than 30, the device will use 30. The min value is 0, which means no retry.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/RetryDelay

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/RetryDelay

When the SCEP server sends pending status, specify device retry waiting time in minutes.

Default value is 5 and the minimum value is 1.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/ServerURL

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/ServerURL

Specify the cert enrollment server.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/SubjectAlternativeNames

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/SubjectAlternativeNames

Specify subject alternative name. Multiple alternative names could be specified by this node. Each name is the combination of name format+actual name. Each pair is separated by semi-comma.

or example, multiple subject alternative names are presented in the format <nameformat1>+<actual name1>;<name format 2>+<actual name2>.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/SubjectName

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/SubjectName

Specify the subject name.

The SubjectName value is quoted if it contains leading or trailing white space or one of the following characters: (,, =, +, ;). For more information, see CertNameToStrA function.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/TemplateName

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/TemplateName

Certificate Template Name OID (As in AD used by PKI infrastructure.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Get

MY/SCEP/{UniqueID}/Install/ValidPeriod

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/ValidPeriod

Specify the period of time that cert is valid. The valid period specified by MDM will overwrite the valid period specified in cert template.

Valid values are one of the following:

Days (default)
Months
Years

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

MY/SCEP/{UniqueID}/Install/ValidPeriodUnit

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Install/ValidPeriodUnit

Specify valid period unit type.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Get

Default is 0. The period is defined in ValidPeriod node. The valid period specified by MDM overwrites the valid period specified in the certificate template. For example, if ValidPeriod is days and ValidPeriodUnits is 30, it means the total valid duration is 30 days.

Note

The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) of the SCEP server as part of certificate enrollment request. How this valid period is used to create the certificate depends on the MDM server.

MY/SCEP/{UniqueID}/Status

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/SCEP/{UniqueID}/Status

Specify the latest status for the certificate due to enroll request.

Valid values are one of the following values:

1: Finished successfully.
2: Pending. The device hasn't finished the action, but has received the SCEP server pending response.
16: Action failed.
32: Unknown.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Get

MY/User

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/User

This store holds the User portion of the MY store.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

MY/User/{CertHash}

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/User/{CertHash}

The SHA1 hash for the certificate. The 20-byte SHA1 hash of the certificate is specified in hexadecimal. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Delete, Get
Dynamic Node Naming	UniqueName: The SHA1 hash for the certificate.

MY/User/{CertHash}/EncodedCertificate

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/User/{CertHash}/EncodedCertificate

The base64 Encoded X.509 certificate. Note that though during MDM enrollment, enrollment server could use WAP XML format to add public part of MDM client cert via EncodedCertificate node, properly enroll a client certificate including private needs a cert enroll protocol handle it or user installs it manually. In WP, the server can't purely rely on CertificateStore CSP to install a client certificate including private key.

Description framework properties:

Property name	Property value
Format	`b64`
Access Type	Add, Get, Replace

MY/User/{CertHash}/IssuedBy

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/User/{CertHash}/IssuedBy

The name of the certificate issuer. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

MY/User/{CertHash}/IssuedTo

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/User/{CertHash}/IssuedTo

The name of the certificate subject. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

MY/User/{CertHash}/TemplateName

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/User/{CertHash}/TemplateName

Returns the certificate template name.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

MY/User/{CertHash}/ValidFrom

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/User/{CertHash}/ValidFrom

The starting date of the certificate's validity. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

MY/User/{CertHash}/ValidTo

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/User/{CertHash}/ValidTo

The expiration date of the certificate. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

MY/WSTEP

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP

The parent node that hosts client certificate that's enrolled via WSTEP, e.g. the certificate that's enrolled during MDM enrollment.

The nodes under WSTEP are mostly for MDM client certificate renew requests.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

MY/WSTEP/CertThumprint

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/CertThumprint

The thumb print of enrolled MDM client certificate.

If renewal succeeds, it shows the renewed certificate thumbprint. If renewal fails or is in progress, it shows the thumbprint of the cert that needs to be renewed.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

MY/WSTEP/Renew

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/Renew

The parent node to group renewal related settings.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get
Atomic Required	True

MY/WSTEP/Renew/ErrorCode

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/Renew/ErrorCode

If certificate renew fails, this node provide the last hresult code during renew process.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Get

MY/WSTEP/Renew/LastRenewalAttemptTime

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/Renew/LastRenewalAttemptTime

Time of last attempted renew.

Description framework properties:

Property name	Property value
Format	`time`
Access Type	Get

MY/WSTEP/Renew/RenewNow

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/Renew/RenewNow

Initiate a renew now.

Description framework properties:

Property name	Property value
Format	`null`
Access Type	Exec

MY/WSTEP/Renew/RenewPeriod

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/Renew/RenewPeriod

Specify the number of days prior to the enrollment cert expiration to prompt the user to renew.

The MDM server can't set and update the renewal period. This parameter applies to both manual certificate renewal and request on behalf of (ROBO) certificate renewal. It's recommended that the renew period is set a couple of months before the certificate expires to ensure that the certificate gets renewed successfully with data connectivity.

The default value is 42 and the valid values are 1-1000.

Note

When you set the renewal schedule over SyncML DM commands to ROBOSupport, RenewalPeriod, and RetryInterval, you must wrap them in Atomic commands.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Add, Delete, Get, Replace
Allowed Values	Range: `[1-1000]`
Default Value	42

MY/WSTEP/Renew/RetryAfterExpiryInterval

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1703 [10.0.15063] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/Renew/RetryAfterExpiryInterval

How long after the enrollment cert has expiried to keep trying to renew.

Description framework properties:

Property name	Property value
Format	`time`
Access Type	Add, Get, Replace

MY/WSTEP/Renew/RetryInterval

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/Renew/RetryInterval

Optional. This parameter specifies retry interval when previous renew failed (in days). It applies to both manual cert renewal and ROBO cert renewal. Retry schedule will stop at cert expiration date. For ROBO renewal failure, the client retries the renewal periodically until the device reaches the certificate expiration date. This parameter specifies the waiting period for ROBO renewal retries. For manual retry failure, there are no built-in retries. The user can retry later. At the next scheduled certificate renewal retry period, the device prompts the credential dialog again. The default value is 7 and the valid values are 1 - 1000 AND =< RenewalPeriod, otherwise it will result in errors. Value type is an integer.

Note

When you set the renewal schedule over SyncML DM commands to ROBOSupport, RenewalPeriod, and RetryInterval, you must wrap them in Atomic commands.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Add, Delete, Get, Replace
Allowed Values	Range: `[1-1000]`
Default Value	7

MY/WSTEP/Renew/ROBOSupport

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/Renew/ROBOSupport

Optional. Notify the client whether enrollment server supports ROBO auto certificate renew. NOTE: This flag is only needed to the device which is MDM enrolled via On-premise authentication method. For MDM enrolled with federated authentication, ROBO is the only supported renewal method. If the server sets this node value to be false or delete this node for federated enrolled device, the configuration will fail with OMA DM error code 405.

Note

When you set the renewal schedule over SyncML DM commands to ROBOSupport, RenewalPeriod, and RetryInterval, you must wrap them in Atomic commands.

Description framework properties:

Property name	Property value
Format	`bool`
Access Type	Add, Delete, Get, Replace
Default Value	true

Allowed values:

Value	Description
true (Default)	True.
false	False.

MY/WSTEP/Renew/ServerURL

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/Renew/ServerURL

Optional. Specifies the cert renewal server URL which is the discovery server.

If this node doesn't exist, the client uses the initial certificate enrollment URL.

Note

The renewal process follows the same steps as device enrollment, which means that it starts with Discovery service, followed by Enrollment policy service, and then Enrollment web service.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Delete, Get, Replace

MY/WSTEP/Renew/Status

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/MY/WSTEP/Renew/Status

Show the latest action status for this certificate. Supported values are one of the following: 0 - Not started. 1 - Renewal in progress. 2 - Renewal succeeded. 3 - Renewal failed.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Get

ROOT

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT

This store holds only root (self-signed) certificates.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

ROOT/{CertHash}

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/{CertHash}

The SHA1 hash for the certificate. The 20-byte SHA1 hash of the certificate is specified in hexadecimal. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Delete, Get
Dynamic Node Naming	UniqueName: The SHA1 hash for the certificate.

ROOT/{CertHash}/EncodedCertificate

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/{CertHash}/EncodedCertificate

The base64 Encoded X.509 certificate.

Description framework properties:

Property name	Property value
Format	`b64`
Access Type	Add, Get, Replace

ROOT/{CertHash}/IssuedBy

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/{CertHash}/IssuedBy

The name of the certificate issuer. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

ROOT/{CertHash}/IssuedTo

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/{CertHash}/IssuedTo

The name of the certificate subject. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

ROOT/{CertHash}/TemplateName

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/{CertHash}/TemplateName

Returns the certificate template name.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

ROOT/{CertHash}/ValidFrom

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/{CertHash}/ValidFrom

The starting date of the certificate's validity. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

ROOT/{CertHash}/ValidTo

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/{CertHash}/ValidTo

The expiration date of the certificate. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

ROOT/System

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/System

This store holds the System portion of the root store.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

ROOT/System/{CertHash}

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/System/{CertHash}

The SHA1 hash for the certificate. The 20-byte SHA1 hash of the certificate is specified in hexadecimal. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Delete, Get
Dynamic Node Naming	UniqueName: The SHA1 hash for the certificate.

ROOT/System/{CertHash}/EncodedCertificate

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/System/{CertHash}/EncodedCertificate

The base64 Encoded X.509 certificate.

Description framework properties:

Property name	Property value
Format	`b64`
Access Type	Add, Get, Replace

ROOT/System/{CertHash}/IssuedBy

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/System/{CertHash}/IssuedBy

The name of the certificate issuer. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

ROOT/System/{CertHash}/IssuedTo

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/System/{CertHash}/IssuedTo

The name of the certificate subject. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

ROOT/System/{CertHash}/TemplateName

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/System/{CertHash}/TemplateName

Returns the certificate template name.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

ROOT/System/{CertHash}/ValidFrom

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/System/{CertHash}/ValidFrom

The starting date of the certificate's validity. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

ROOT/System/{CertHash}/ValidTo

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/CertificateStore/ROOT/System/{CertHash}/ValidTo

The expiration date of the certificate. This node is implicitly created only when the EncodedCertificate node is added.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Get

Examples

Add a root certificate to the MDM server.

<Add>
   <CmdID>1</CmdID>
   <Item>
      <Target>
         <LocURI>
./Vendor/MSFT/CertificateStore/Root/System/<CertificateHashInsertedhere>/EncodedCertificate
          </LocURI>
      </Target>
      <Data>B64EncodedCertInsertedHere</Data>
      <Meta>
         <Format xmlns="syncml:metinf">b64</Format>
      </Meta>
   </Item>
</Add>

Get all installed client certificates.

<Get>
   <CmdID>1</CmdID>
   <Item>
      <Target>
         <LocURI>
./Vendor/MSFT/CertificateStore/My/User?list=StructData
          </LocURI>
      </Target>
   </Item>
</Get>

Delete a root certificate.

<Delete>
   <CmdID>1</CmdID>
   <Item>
      <Target>
         <LocURI>
./Vendor/MSFT/CertificateStore/Root/System/<CertificateHashInsertedHere>
          </LocURI>
      </Target>
   </Item>
</Delete>

Configure the device to enroll a client certificate through SCEP.

<Atomic>
<CmdID>100</CmdID>
<Add>
   <CmdID>1</CmdID>
   <Item>
        <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1</LocURI>
        </Target>
        <Meta>
        <Format xmlns="syncml:metinf">node</Format>
        </Meta>
   </Item>
</Add>
<Add>
    <CmdID>2</CmdID>
    <Item>
        <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/RetryCount</LocURI>
        </Target>
    <Meta>
               <Format xmlns="syncml:metinf">int</Format>
    </Meta>
            <Data>1</Data>
    </Item>
</Add>
<Add>
         <CmdID>3</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/RetryDelay</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">int</Format>
            </Meta>
            <Data>1</Data>
         </Item>
</Add>
<Add>
         <CmdID>4</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/KeyUsage</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">int</Format>
            </Meta>
            <Data>160</Data>
         </Item>
</Add>
<Add>
         <CmdID>5</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/KeyLength</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">int</Format>
            </Meta>
            <Data>1024</Data>
         </Item>
</Add>
<Add>
         <CmdID>6</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/HashAlgorithm</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">chr</Format>
            </Meta>
            <Data>SHA-1</Data>
         </Item>
</Add>
<Add>
         <CmdID>7</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/SubjectName</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">chr</Format>
            </Meta>
            <Data>CN=AnnaLee</Data>
         </Item>
</Add>
<Add>
         <CmdID>8</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/SubjectAlternativeNames</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">chr</Format>
            </Meta>
            <Data>11+tom@MyDomain.Contoso.com;3+MyDomain.Contoso.com</Data>
         </Item>
</Add>
<Add>
         <CmdID>9</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/ValidPeriod</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">chr</Format>
            </Meta>
            <Data>Years</Data>
         </Item>
</Add>
<Add>
         <CmdID>10</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/ValidPeriodUnits</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">int</Format>
            </Meta>
            <Data>1</Data>
         </Item>
</Add>
<Add>
         <CmdID>11</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/EKUMapping</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">chr</Format>
            </Meta>
            <Data>1.3.6.1.4.1.311.10.3.12+1.3.6.1.4.1.311.10.3.4+1.3.6.1.4.1.311.20.2.2</Data>
         </Item>
</Add>
<Add>
         <CmdID>12</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/KeyProtection</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">int</Format>
            </Meta>
            <Data>3</Data>
         </Item>
</Add>
<Add>
         <CmdID>13</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/ServerURL</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">chr</Format>
            </Meta>
            <Data>https://contoso.com/certsrv/ctcep.dll</Data>
         </Item>
</Add>
<Add>
         <CmdID>14</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/Challenge</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">chr</Format>
            </Meta>
            <Data>ChallengeInsertedHere</Data>
         </Item>
</Add>
<Add>
         <CmdID>15</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/CAThumbprint</LocURI>
            </Target>
            <Meta>
               <Format xmlns="syncml:metinf">chr</Format>
            </Meta>
            <Data>CAThumbprintInsertedHere</Data>
         </Item>
</Add>
<Exec>
         <CmdID>16</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/SCEP/CertSCEP1/Install/Enroll</LocURI>
            </Target>
         </Item>
</Exec>
</Atomic>

Configure the device to automatically renew an MDM client certificate with the specified renew period and retry interval.

<Atomic>
   <CmdID>1</CmdID>
     <Replace>
         <CmdID>2</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/WSTEP/Renew/ROBOSupport</LocURI></Target>
            <Meta>
               <Format xmlns="syncml:metinf">bool</Format>
            </Meta>
            <Data>true</Data>
         </Item>
      </Replace>
      <Replace>
         <CmdID>3</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/WSTEP/Renew/RenewPeriod</LocURI></Target>
            <Meta>
               <Format xmlns="syncml:metinf">int</Format>
            </Meta>
            <Data>60</Data>
         </Item>
      </Replace>
      <Replace>
         <CmdID>4</CmdID>
         <Item>
            <Target><LocURI>./Vendor/MSFT/CertificateStore/My/WSTEP/Renew/RetryInterval</LocURI></Target>
            <Meta>
               <Format xmlns="syncml:metinf">int</Format>
            </Meta>
            <Data>4</Data>
         </Item>
      </Replace>
</Atomic>

Configuration service provider reference

Share via

CertificateStore CSP

CA

CA/{CertHash}

CA/{CertHash}/EncodedCertificate

CA/{CertHash}/IssuedBy

CA/{CertHash}/IssuedTo

CA/{CertHash}/TemplateName

CA/{CertHash}/ValidFrom

CA/{CertHash}/ValidTo

CA/System

CA/System/{CertHash}

CA/System/{CertHash}/EncodedCertificate

CA/System/{CertHash}/IssuedBy

CA/System/{CertHash}/IssuedTo

CA/System/{CertHash}/TemplateName

CA/System/{CertHash}/ValidFrom

CA/System/{CertHash}/ValidTo

MY

MY/SCEP

MY/SCEP/{UniqueID}

MY/SCEP/{UniqueID}/CertThumbPrint

MY/SCEP/{UniqueID}/ErrorCode

MY/SCEP/{UniqueID}/Install

MY/SCEP/{UniqueID}/Install/CAThumbPrint

MY/SCEP/{UniqueID}/Install/Challenge

MY/SCEP/{UniqueID}/Install/EKUMapping

MY/SCEP/{UniqueID}/Install/Enroll

MY/SCEP/{UniqueID}/Install/HashAlgrithm

MY/SCEP/{UniqueID}/Install/KeyLength

MY/SCEP/{UniqueID}/Install/KeyProtection

MY/SCEP/{UniqueID}/Install/KeyUsage

MY/SCEP/{UniqueID}/Install/RetryCount

MY/SCEP/{UniqueID}/Install/RetryDelay

MY/SCEP/{UniqueID}/Install/ServerURL

MY/SCEP/{UniqueID}/Install/SubjectAlternativeNames

MY/SCEP/{UniqueID}/Install/SubjectName

MY/SCEP/{UniqueID}/Install/TemplateName

MY/SCEP/{UniqueID}/Install/ValidPeriod

MY/SCEP/{UniqueID}/Install/ValidPeriodUnit

MY/SCEP/{UniqueID}/Status

MY/User

MY/User/{CertHash}

MY/User/{CertHash}/EncodedCertificate

MY/User/{CertHash}/IssuedBy

MY/User/{CertHash}/IssuedTo

MY/User/{CertHash}/TemplateName

MY/User/{CertHash}/ValidFrom

MY/User/{CertHash}/ValidTo

MY/WSTEP

MY/WSTEP/CertThumprint

MY/WSTEP/Renew

MY/WSTEP/Renew/ErrorCode

MY/WSTEP/Renew/LastRenewalAttemptTime

MY/WSTEP/Renew/RenewNow

MY/WSTEP/Renew/RenewPeriod

MY/WSTEP/Renew/RetryAfterExpiryInterval

MY/WSTEP/Renew/RetryInterval

MY/WSTEP/Renew/ROBOSupport

MY/WSTEP/Renew/ServerURL

MY/WSTEP/Renew/Status

ROOT

ROOT/{CertHash}

ROOT/{CertHash}/EncodedCertificate

ROOT/{CertHash}/IssuedBy

ROOT/{CertHash}/IssuedTo

ROOT/{CertHash}/TemplateName

ROOT/{CertHash}/ValidFrom

ROOT/{CertHash}/ValidTo

ROOT/System

ROOT/System/{CertHash}

ROOT/System/{CertHash}/EncodedCertificate

ROOT/System/{CertHash}/IssuedBy

ROOT/System/{CertHash}/IssuedTo

ROOT/System/{CertHash}/TemplateName

ROOT/System/{CertHash}/ValidFrom

ROOT/System/{CertHash}/ValidTo

Examples

Related articles

Feedback