> For the complete documentation index, see [llms.txt](https://docs.scepman.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.scepman.com/certificate-management/static-certificates/kandji-1.md).

# Iru (formerly Kandji)

Issue certificates in Iru by connecting SCEPman as an External CA. Devices will be able to obtain certificates using SCEPman's static interface and a challenge password enrolled.

SCEPman can be connected to [Iru](https://www.iru.com/) as an External CA using SCEPman's static interface and a challenge password, enabling enrolled devices to obtain certificates.

For more general information about other MDM solutions and SCEPman integration, please check [here](/certificate-management/static-certificates.md).

## Enable Iru Integration

Integration of SCEPman can be easily enabled via the following environment variables on SCEPman App Service:

{% hint style="info" %}
You can differentiate between the SCEPman App Service and the Certificate Master by looking for the App Service **without** the "-cm" in its name
{% endhint %}

|                                                                                                Setting                                                                                                | Description                                                                                                                                                                                                                                                                                          |                     Value                    |
| :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------: |
|                        [AppConfig:StaticValidation:Enabled](/scepman-configuration/application-settings/scep-endpoints/static-validation.md#appconfig-staticvalidation-enabled)                       | Enable 3rd-party validation                                                                                                                                                                                                                                                                          | ***true*** to enable, ***false*** to disable |
|                [AppConfig:StaticValidation:RequestPassword](/scepman-configuration/application-settings/scep-endpoints/static-validation.md#appconfig-staticvalidation-requestpassword)               | <p>Certificate signing requests sent to SCEPman for signing are authenticated with this secure static password<br><br><strong>Recommendation</strong>: Store this secret in <a href="/scepman-configuration/application-settings.md#secure-configuration-in-azure-key-vault">Azure KeyVault</a>.</p> |      *generate a 32 character password*      |
|       [AppConfig:StaticValidation:ValidityPeriodDays](/scepman-configuration/application-settings/scep-endpoints/static-validation.md#appconfig-staticvalidation-validityperioddays) (optional)       | Days certificates issued via Iru are valid                                                                                                                                                                                                                                                           |                      365                     |
| [AppConfig:StaticValidation:EnableCertificateStorage](/scepman-configuration/application-settings/scep-endpoints/static-validation.md#appconfig-staticvalidation-enablecertificatestorage) (optional) | Store requested certificates in the Storage Account, in order to show them in SCEPman Certificate Master                                                                                                                                                                                             | ***true*** to enable, ***false** to disable* |

{% hint style="warning" %}
After adding or editing SCEPman configuration parameters, you need to restart the App Service.
{% endhint %}

## Iru Configuration

### SCEPman Root Certificate

As a first step, you must deploy SCEPman's root certificate. Download this CA certificate via the SCEPman website:

![SCEPman Website](https://2535731700-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LoGejQeUQcw7lqnQ3WX%2Fuploads%2Fgit-blob-9170eb0435726398eb43f6fac8abd0d5f35e8cc4%2FSCEPmanHomePage%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(1\)%20\(2\)%20\(1\)%20\(2\).png?alt=media)

In Iru, navigate to **Library** on the left navigation bar and add a **Certificate Library Item** to your Blueprint.

<figure><img src="https://2535731700-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LoGejQeUQcw7lqnQ3WX%2Fuploads%2FfToUgpoUeZOiYNe2xkzi%2F2023-03-09%2012_51_21-Window.png?alt=media&amp;token=df6f66fb-369b-4adf-ab9d-70757354f2f7" alt=""><figcaption><p>Configure a Certificate Payload</p></figcaption></figure>

To upload the certificate, first select **PKCS #1-formatted certificate** under **Certificate type**, secondly provide an optional name, upload your SCEPman CA certificate, and eventually save it.

<figure><img src="https://2535731700-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LoGejQeUQcw7lqnQ3WX%2Fuploads%2FL8NyfsJR7x2v0j6ybS6g%2F2023-03-09%2014_21_12-KandjiSCEPmanRootCA.png?alt=media&amp;token=a70ff955-bbe2-4b49-9cf4-245964838675" alt=""><figcaption><p>Adding the SCEPman Root CA Certificate</p></figcaption></figure>

### SCEP Profile

The second step is to add a **SCEP Profile** to your **Blueprint**. Therefore, add a new **SCEP Library Item** and configure it as below:

* **URL**: The static SCEP endpoint of SCEPman you configured [above](#enable-kandji-integration)
* **Name:** An optional SAN attribute
* **Challenge**: Is required to authenticate CSR requests sent to SCEPman's static SCEP interface. It must match the [value](/scepman-configuration/application-settings/scep-endpoints/static-validation.md#appconfig-staticvalidation-requestpassword) you have configured [above](#enable-kandji-integration).
* **Fingerprint:** Optional CA fingerprint. It is highly recommended to configure this value as it provides an additional level of security. You can find it on your SCEPman website as **CA Thumbprint**.
* **Subject:** Optional subject name. **CN=$PROFILE\_UUID** will be automatically added from Iru as default common name. Iru allows you to add multiple CNs.

{% hint style="warning" %}
Occasionally macOS and iOS had problems auto-selecting client certificates for network authentication purposes when more than two CNs are added.
{% endhint %}

* **Key Size:** 2048
* **Key Usage:** Both, signing and encryption

For more information, please check [Iru's documentation](https://support.kandji.io/support/solutions/articles/72000559782-scep-profile).

<figure><img src="https://2535731700-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LoGejQeUQcw7lqnQ3WX%2Fuploads%2FS84P4c40cLu5H5NCeley%2F2023-03-09%2014_43_19-Kandji.png?alt=media&amp;token=45fdf5b6-6a31-4879-ba87-a7070e76e0c5" alt=""><figcaption><p>Adding a SCEP Profile</p></figcaption></figure>

<figure><img src="https://2535731700-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LoGejQeUQcw7lqnQ3WX%2Fuploads%2FhnTLPcfOXlMpBNOh5Nph%2F2023-03-09%2014_50_23-Kandji.png?alt=media&amp;token=1ed96cb6-861a-4cb7-8511-22e1b0b48763" alt=""><figcaption><p>SCEP Profile Configuration</p></figcaption></figure>

<figure><img src="https://2535731700-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LoGejQeUQcw7lqnQ3WX%2Fuploads%2FbZiDYnqsvxgh8a36zPl3%2F2023-03-09%2014_51_22-Kandji.png?alt=media&amp;token=d2e681dd-f50d-4043-a85a-46bd7396d810" alt=""><figcaption><p>SCEP Profile Configuration</p></figcaption></figure>

<figure><img src="https://2535731700-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LoGejQeUQcw7lqnQ3WX%2Fuploads%2FuiSTD2BxR4utzJ0YACZS%2F2023-03-09%2014_52_52-Kandji.png?alt=media&amp;token=84aa9c64-7b38-4829-b337-cdde8549ab98" alt=""><figcaption><p>SCEP Profile Configuration</p></figcaption></figure>

### Deployment Status

After saving the certificate or SCEP profile, switch to **Status** to check the deployment status on **Blueprints** assigned devices.

<figure><img src="https://2535731700-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LoGejQeUQcw7lqnQ3WX%2Fuploads%2FjchSJJzjqEDQxfX8K40s%2F2023-03-09%2015_12_40-Kandji.png?alt=media&amp;token=5b316771-d526-45cc-8ee5-dba4d751e39f" alt=""><figcaption><p>Deployment Status</p></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.scepman.com/certificate-management/static-certificates/kandji-1.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.