Transferring Entrust Certificates to Mobile Phones 

Transfer your certificates using one of these two procedures:

• A. Certificate Transfer Using Self-Service Portal

  • Samsung

    1. On your computer, go to EMDM-GAME - Prod 2 to access the self-serve portal.
    2. Once you are on the Self-Service Portal main page, change the Sign in using field to LDAP authentication.
       • 
       • (NOTE: by selecting LDAP authentication, the Domain field will disappear.)
    3. Input your Windows username in the Username field (the same one you use to log into your work computer).
    4. Input your Windows password in the Password field.
    5. Click Sign in button.
       • 
       • NOTE:If you receive an error message, please proceed to the appropriate Certificate Transfer using Email section and follow that procedure. In order to resolve the Self-Service Portal issue, please open an online Service Request with the National Service Desk. The user account requires recreation and reactivation.
    6. Upon successful login, the following will appear:
       • 
    7. Click on Certificates on the left-hand side of the screen.
       Note: If under the Certificate column you see that you have previously uploaded certificates (i.e., you see the name of a certificate instead of "Add a client certificate"), you must first delete them from this screen before proceeding.
    8. Under Assigned client certificates, click on Add a client certificate for your respective device (KNOX for Samsung, iOS for iPhone) type for your Verify/Signing key.
       • 
    9. Click Browse,
       • If you used the automated method to export your certifications from your Desktop or Laptop, navigate and select your Signing/Verification key located in your F: drive (Surname, FirstName's Verification Certificate) and then click Open.
       • If you used the manual method to export your certifications from your Desktop or Laptop, navigate and select your Signing/Verification key you previously saved on your local computer (Verification) and then click Open.
    10. Type the password for your Verify/Signing key in the Password field.
    11. Click Add.
    12. Under Assigned client certificates; click on Add a client certificate for your respective device type for your Encryption key.
    13. Click Browse,
        • If you used the automated method to export your certifications from your Desktop or Laptop, navigate and select your Encryption key located in your F: drive (Surname, FirstName's Encryption Certificate) and then click Open.
        • If you used the manual method to export your certifications from your Desktop or Laptop, navigate and select your Encryption key that you previously saved on your local computer (Encryption) and then click Open.
    14. Type the password for your Encryption key in the Password field.
    15. Click Add.
    16. Click Log out within the Self-Service Portal. (Next step will be on your Samsung phone.)
    17. On your Samsung phone, open the email client on Knox/Workspace.
    18. Tap (Menu) in the email client main menu.
    19. Tap (Menu) in the email client main menu.
        • 
    20. Tap on your email address in the Accounts section.
        • 
    21. Scroll down and tap the Security Options menu.
        • 
    22. Select Encryption Certificate.
        • 
    23. Select Encryption radio button.
    24. Select Allow.
        • 
        • The email application should return to the selection dialog again.
    25. Select Signing Certificate.
        • 
    26. Select Verification radio button.
    27. Select Allow.
        • 
    28. Select Encryption Algorithm dropdown.
    29. Select AES 256bit. (Note: AES 128bit may need to be selected if you have not been upgraded to SHA2 certs yet)
        • 
    30. Select Sign Algorithm.
    31. Select SHA256. (Note: SHA1 may need to be selected if you have not been upgraded to SHA2 certs yet)
        • 
    32. Select Done at top right of the screen to exit the email client Security Options dialog.
    33. Go to Testing the Certificates on your Device section to test.

    • End of Samsung Step 2A
    •  
  • iPhone

    1. On your computer, go to EMDM-GAME – Prod 2 to access the self-serve portal.
    2. Once you are on the Self-Service Portal main page, change the Sign in using field to LDAP authentication
       • 
       • (NOTE: by selecting LDAP authentication, the Domain field will disappear.)
    3. Input your Windows username in the Username field (the same one you use to log into your work computer).
    4. Input your Windows password in the Password field.
    5. Click Sign in button.
       • 
       • NOTE: If you receive an error message, please proceed to the appropriate Certificate Transfer using Email section and follow that procedure. In order to resolve the Self-Service Portal issue, please open an online Service Request with the National Service Desk. The user account requires recreation and reactivation.
    6. Upon successful login, the following will appear:
       • 
    7. Click on Certificates on the left hand side of the screen.
       • Note: If under the Certificate column you see that you have previously uploaded certificates (i.e., you see the name of a certificate instead of "Add a client certificate"), you must first delete them from this screen before proceeding.
    8. Under Assigned client certificates, click on Add a client certificate for your respective device (KNOX for Samsung, iOS for iPhone) type for your Verify/Signing key.
       • 
    9. Click Browse, navigate and select your Signing/Verification key that you previously saved on your local computer (Verification) and then click Open.
    10. Type the password for your Verify/Signing key in the Password field.
    11. Click Add.
    12. Under Assigned client certificates; click on Add a client certificate for your respective device type for your Encryption key.
    13. Click Browse, navigate and select your Encryption key that you previously saved on your local computer (Encryption) and then click Open.
    14. Type the password for your Encryption key in the Password field.
    15. Click Add.
    16. Click Log out within the Self-Service Portal.

    The process is now complete. Please wait ~5 minutes for the profile to be pushed to your device. If you open the mail application too early, you can expect the mail application to close when to profile is being pushed. Afterward proceed to Step 3: Email Test

    • End of iPhone Step 2A
    •  
• ** Should you not be able to log into the portal; you can use the email process instead (method B. below).
• B. Certificate Transfer Using Email

  • Samsung

    • Use this email procedure if you were not able to log into the self-serve portal.
    • After you have exported and saved your certificates to your desktop/laptop, then create an e-mail message, address it to yourself and attach the two certificates you just saved (ensure email message subject line does not describe the message content).

    1. From the Android Mobile Device email, select the email with the certificates attached to it.
       • 
    2. Within that E-mail tap Save beside the Encryption certificate.
       • 
    3. Exit the email client and open the MY FILES within KNOX/WORKSPACE.
    4. Select the Encryption.pfx file.
       • 
    5. Enter the previously created password and tap OK.
    6. Change the certificate name to Encryption and tap OK.
       • 
    7. Upon successful certificate import, Encryption installed will be displayed at the bottom of the screen.
       • 
    8. Repeat steps 1-7 and substitute Verification for Encryption in all steps to import the Verification Certificate.
    9. Continue upon successful installation of both Encryption and Verification certificates.
    10. Open the email client on Knox/Workspace.
    11. Tap the 3 bars to open the email client main menu.
    12. Tap the Settings cog icon in the upper right-hand corner.
        • 
    13. Tap on your email address in the Accounts section.
        • 
    14. Scroll down and tap on Security Options.
        • 
    15. Select Encryption Certificate.
        • 
    16. Tap Encryption Radio Button, and tap Allow.
        • 
          
          The email application should return to the selection dialog again.
    17. Tap Signing Certificate.
        • 
    18. Tap Verification radio button and tap Allow.
        • 
    19. Tap Encryption Algorithm drop down and tap AES 256bit. (Note: AES 128bit may need to be selected if you have not been upgraded to SHA2 certs yet)
        • 
    20. Tap Sign Algorithm, and tap SHA256. (Note: SHA1 may need to be selected if you have not been upgraded to SHA2 certs yet)
        • 
    21. 21. Select Done at top right of the screen to exit the email client Security Options dialog.
    22. Go to Testing the Certificates on your Device section to test.
        • End of Step 2B
        •  

    • End of Samsung Step 2
    •  
  • iPhone

    Use this email procedure if you were not able to log into the self-serve portal.

    Important: This procedure will only work if iOS 12.0 and above is installed on your mobile phone. To check the version on your iPhone, tap Settings > General > About > Version.

    1. On your computer or laptop, create an e-mail message, address it to yourself and attach the two certificates you saved when you completed the procedure in Step 1 (ensure email message subject line does not describe the message content).
    2. On your mobile phone, open the email you just sent to yourself.
    3. Start by opening the .pfx file for either Signing or Encryption by tapping on it.
    4. When prompted, tap Install.
    5. Enter the device passcode, press Done.
       • 
    6. Confirm installing the unsigned profile by tapping Install, then Install.
       • 
    7. Enter the passphrase, which protects the Identity Certificate file, then click Next.
    8. That will install the certificate on the device, you should then click Done.
       • 
    9. Repeat steps 2-8 again and substitute Verification for Encryption in all steps to import the Verification Certificate.

    Once both certificates have been imported, you'll need to choose the cert on the account to use it for S/MIME.
    Follow the next steps on how to do so.

    10. In the Settings app, Navigate to Passwords & Accounts > [ The GoC mail account ] > Account > Advanced Settings, in the S/MIME section, tap Sign.
        • 
    11. In the Sign settings, toggle Sign on, tap the newly installed certificate (tap the i button to inspect the cert's details if required), then toggle Sign off again, and tap Back.
        • Note: We toggle the slider to select the signing certificate, but then turn it back off so not every message gets sent as "Signed" by default.
        • 
    12. Go back and tap the newly installed certificate for Encrypt by Default.
    13. Finally, tap the Back button, tap Account, and tap Done to save your selections.
    14. 

    • End of iPhone Step 2B
    •  

• Once all the steps to import the certificates to your device are completed, test that the certificates are working by sending yourself an email that is encrypted and verify you can open and read its contents.
  1. Create an email to yourself.
  2. Select Security Options in the Options Menu and select Encrypt; then select Done and select Send.
  3. Verify that you have received and can read the Test email.