Revoking Unique Device Credentials; Figure 6 Relationship Of Certificates In The Onboard Public Key Infrastructure - Aruba Networks PowerConnect W Clearpass 100 Software Deployment Manual

Figure 6 Relationship of Certificates in the Onboard Public Key Infrastructure

The root certificate authority (CA) is typically an enterprise certificate authority, with one or more
intermediate CAs used to issue certificates within the enterprise.
Onboard may operate as a root CA directly, or as an intermediate CA. See
Authority
The Onboard CA issues certificates for several purposes:
The Profile Signing Certificate is used to digitally sign configuration profiles that are sent to iOS

devices.
The identity information in the profile signing certificate is displayed during device provisioning.

One or more Server Certificates may be issued for various reasons – typically, for an enterprise's

authentication server.
The identity information in the server certificate may be displayed during network authentication.

One or more Device Certificates may be issued – typically, one or two per provisioned device.

The identity information in the device certificate uniquely identifies the device and the user that

provisioned the device.
You do not need to manually create the profile signing certificate; it is created when it is needed. See
"Configuring Provisioning Settings for iOS and OS
You may revoke the profile signing certificate; it will be recreated when it is needed for the next device
provisioning attempt.

Revoking Unique Device Credentials

Because each provisioned device uses unique credentials to access the network, it is possible to disable
network access for an individual device. This offers a greater degree of control than traditional user-based
authentication — disabling a user's account would impact all devices using those credentials.
ClearPass Guest 3.9 | Deployment Guide
".
"Configuring the Certificate
X"to control the contents of this certificate.
Onboard | 53