SafeMobile and SafeTech Lab have integrated their MDM system and corporate certificate authority (CA) to facilitate the transition from Microsoft Certificate Authority. This integration allows mobile devices to maintain access to corporate Wi-Fi, VPN, and email services during the migration process.
The solution utilizes the SCEP protocol for certificate enrollment. Unlike standard implementations, the SafeMobile SCEP server uses unique challenges for each device and purpose, preventing unauthorized certificate issuance. The system validates requests against user and device data before the registration agent forwards them to the SafeTech CA via REST API.
The SafeTech CA is a Linux-based solution registered in the Russian software registry and certified by the FSTEC of Russia at the 4th level of trust. It supports deployment in Kubernetes and integration with hardware security modules (HSM). Licensing is based on the number of CA instances rather than the number of users or certificates.
The integration supports automated certificate lifecycle management, including renewal and revocation. When a device is removed from management, SafeMobile triggers an automatic revocation in the SafeTech CA. The system also supports MS-WSTEP, allowing Windows machines to continue receiving certificates via group policies during the transition from Microsoft CA.