The Windows Certificate Install Policy allows administrators to deploy digital certificates to managed Windows devices.
This policy supports both BYOD and corporate-owned deployments and provides a secure, automated method to install certificates required for:
Wi-Fi authentication (e.g., WPA2-Enterprise / EAP-TLS)
VPN authentication
SSL inspection
Application authentication
Internal services and identity providers
By using this policy, organizations can eliminate manual certificate installation and ensure consistent, compliant device setup across their Windows fleet.
For example, here is how to use this policy to install an SCEP Profile from Okta to Windows Devices.
Requirements
Windows 10 or later
Overview
Digital certificates are essential for secure authentication and encrypted communication.
The Windows Certificate Install Policy pushes a certificate payload directly to the user or device certificate store via MDM.
This ensures:
No user interaction is required
Certificates are installed silently
Devices remain compliant with security and access requirements
Certificate-based network and app access works immediately after provisioning
This policy is especially useful for Zero Trust environments or organizations enforcing certificate-based identity.
Configurable Settings
Encoded Certificate
This field accepts your certificate in Base64-encoded format.
The certificate should be encoded using Base64 (PEM format).
The content typically begins with:
-----BEGIN CERTIFICATE-----
and ends with:
-----END CERTIFICATE-----
Uploading the encoded certificate ensures it is delivered securely to the device through the Windows MDM channel.
Use cases include:
802.1X Wi-Fi certificates
VPN client certificates
S/MIME certificates
Root CA certificates for trust
Intermediate CA chains
Note:
If your certificate includes a private key, ensure it is packaged securely—e.g., as a PFX with proper password protection (not all formats are supported in all Windows versions).
Best Practices
Use certificate deployment together with Windows Wi-Fi Policy or Windows VPN Policy for seamless authentication.
Deploy root and intermediate CA certificates before issuing individual device certificates.
For Wi-Fi/EAP-TLS environments, use certificate-based auth to prevent password sharing.
Keep certificates short-lived and rotate regularly for improved security.
Use device groups to target certificates by department, location, or function.
How to Configure
Open the Swif Admin Console
Navigate to Policies → Create New Policy
Select Windows Certificate Install Policy
Paste your Base64-encoded certificate into the field provided
Click Continue
Assign the policy to devices or device groups
Save and apply
Devices will download and install the certificate during their next MDM sync.
Troubleshooting
Certificate does not appear on the device
Ensure the certificate is correctly Base64-encoded
Verify the device is running Windows 10+
Check for formatting issues (newlines, missing BEGIN/END headers)
Confirm the policy is assigned to the correct device group
Wi-Fi or VPN still fails after certificate installation
Confirm the certificate chain (root + intermediate) is installed
Ensure the Wi-Fi or VPN profile references the correct certificate
Check certificate validity and expiration
Confirm the certificate includes required key usages (e.g., Client Auth)