title: Apple MDM OTA - Identity Certificate with SCEP vs PKCS12 embedded within the profile
body: <p>I'm debating and need to know the implications of not using the SCEP protocol for the mdm enrolment, more precisely the Identity certificate (the certificate credential used for authentication). I'm talking about the certificate in the Identity section on IPCU, as shown in the image below, with the red arrow.</p>
  
  <p><a href="https://i.stack.imgur.com/XX58L.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XX58L.png" alt="enter image description here"></a></p>
  
  <p>I wont be pushing down profiles with sensitive informations (like vpn, email, etc configurations and/or passwords).</p>
  
  <p>My use case will be 99%:</p>
  
  <ul>
  <li>Block/unblock apps by rating</li>
  <li>Lock/unlock device</li>
  <li>Block/unlock web domains</li>
  </ul>
  
  <p>From reading around StackOverflow (<a href="https://stackoverflow.com/questions/15024587/ios-mdm-profile-signing-which-certificate-to-use">here</a> and <a href="https://stackoverflow.com/questions/25073276/ios-mdm-enrollment-scep-specification-and-pkioperation-and-operation-pkioperatio/25084605">here</a>) the following scenarios can happen.</p>
  
  <ol>
  <li>If someone get access to the certificate he will be able to impersonate an enrolled device, but he will only be able to receive commands/profiles and not initiate commands/profiles. Am I right? </li>
  <li>A man in the middle attack can get access to the certificate</li>
  </ol>
  
  <p>The advantage of using the PKCS12 embedded within the profile is that it is faster to implement and no external dependencies (SCEP server) but I'm not so sure about the disadvantages. So my questions and doubts is:</p>
  
  <ol start="3">
  <li><p>What can a malicious person do with the private key from the Identity certificate?</p></li>
  <li><p>Can it be a security breach going with the PKCS12 embedded approach?</p></li>
  </ol>
  
  <p>This is mostly a question of SCEP vs PKCS12 embedded within the profile, pros and cons.</p>