Your external DNS must be setup with a trusted SSL certificatie by all device types to ensure poper communication with Workspace ONE UEM. Learn more about setting up the external DNS records and certificates.

The two main components of Workspace ONE UEM are the Device Services server and the Console server. In the standard deployment model, these components are installed on separate servers, and only the Device Services component requires an external DNS record, while the Console component can remain only internally available.

An externally registered DNS record is a friendly name that refers to the IP to tell external devices how to connect to Workspace ONE UEM (the Device Services server). This externally available URL must be set up with a trusted SSL certificate trusted by all device types. For Apple, you can see a list of root certificates natively trusted by iOS On the Apple Support webpage. For other OEMs, check with the OEM to see which third-party certificate authorities are natively trusted. You can also typically retrieve this information from the device by looking for the Trusted Root CAs under Settings.

A wildcard or individual website certificate is required.

Important: Ensure that these steps are performed on both the Workspace ONE UEM console and Device Services servers.
  1. Obtain SSL certificates for each of your external DNS entries. A list of root certificates natively trusted by iOS can be found here: http://support.apple.com/kb/HT5012
  2. On the Workspace ONE UEM console and Device Services Servers, open MMC:
    1. Start > Run
    2. Type mmc
    3. Select OK
  3. In MMC, navigate to File > Add/Remove Snap-in …
  4. Select Certificates from the list of add-ins and select Add.
  5. Choose Computer account and select Next.
  6. Keep Local computer selected and select Finish and OK.

    The Select Computer screen with Local computer selected.

  7. Expand the Certificates folder and right-click Personal.
  8. Select All Tasks and choose Import.
  9. In the Certificate Import Wizard, select Next and perform the following steps:
    1. Click Browse and navigate to the Cert folder, which was staged earlier, and change the file type drop-down to All Files.

      If the drop-down is not changed to All Files, the certificate cannot be selected for import.

    2. Select the appropriate certificate and select Open.

      In a standard, multi-server installation, this certificate is the external third-party certificate for the DS server and for the Console it can be a self-signed or internally issued certificate.

      This certificate must be a PFX file.

    3. Click Next, and complete the following settings:
      • Password: Your certificate password
      • Enable Mark this key as Exportable

        (This setting is optional and allows you to export the certificate from this server to use it on another server.)

      • Enable Include all extended properties
    4. Click Next and select Finish.
    5. Select OK to close the “The import was successful” pop-up.
  10. Expand the Personal folder to show the Certificates folder.
  11. Drag the Root CA Certificate into the Trusted Root Certification Authorities folder. Navigate to Trusted Root Certification Authorities > Certificates and verify that the move was successful.
  12. Navigate back to Personal > Certificates, and drag the Intermediate CA Certificate into the Intermediate Certification Authorities folder. Navigate to Intermediate Certification Authorities > Certificates and verify that the move was successful.
  13. To close MMC, select File > Exit . Select No to save changes.
  14. Open Server Manager, select Roles and expand: Web Server (IIS) > Information Services (IIS) Manager.
  15. In the right pane, under Connections, select the server.
  16. Under the IIS section, double-click on Server Certificates and verify that the certificate is located in the certificate list. An example is shown.

    The Server Certificates screen listing available certificates.

    Once uploaded on your server you can use it to add a 443 binding to the Default website in IIS. Your SSL certificate appears in the drop-down menu of available certificates.

  17. Under Connections, expand Sites and select Default Website.

    The Edit Site Binding screen where you verify your SSL Certificate.

  18. Under Actions, to the far right side, under Edit Site, select Bindings and select Add…
  19. Configure the following settings:
    • Type: https
    • SSL certificate: Your certificate
  20. Click OK and select to Close.

    The IP address and Port are not altered. Do not populate the Hostname with an IP or a DNS entry, since it affects the functionality of the SSL binding. A slight delay occurs when the certificate is bound to the website.

    The Edit Site Binding screen where nothing is altered.

  21. Click OK and select to Close.
  22. Under Actions/Browse Website, verify Browse *.443 (https) is an available option.
  23. Also verify that you have a private key that corresponds to your certificate.

    The Certificate screen where you verify the private key.

  24. Verify that the certificate contains the common name in the subject.

    The Certificate screen where you verify the certificate name.

  25. Verify that your DNS name is listed in the Subject Alternative Name.

    The Certificate screen where you verify your DNS is listed in the Subject Alternative Name.

  26. Validate that you can connect to the server over HTTPS (https://[yourUEMDomain].com). At this point, the IIS splash page displays.
Important: If SSL is used for UEM console access, ensure that FQDN is enabled.