Deploying the root CA certificate using Intune

Deploy the root CA certificate to enrolled macOS endpoints as an Intune Trusted certificate profile, so that it is installed into the System keychain and trusted.

Steps

  1. Get the root CA certificate file.
    Export the root CA certificate in .cer (Base-64 or DER, X.509) format. For Forcepoint, this is usually the CA certificate used for SSL decryption and inspection, provided by your Forcepoint admin console or security team.
  2. Create a Trusted certificate profile in Intune:
    1. Sign in to the Microsoft Intune admin center.
    2. Go to Devices > Manage devices > Configuration > Create > New Policy.
    3. For Platform, select macOS, or the relevant platform for your devices.
    4. For Profile type, choose Templates, and then select Trusted certificate.
    5. Click Create.
  3. Configure the profile:
    1. On the Basics page, enter a name and description for the profile.
      For example, Forcepoint Root CA - macOS.
    2. On the Configuration settings page, upload the .cer file for your root CA.
    3. On the Scope tags page, assign scope tags if your organization uses them.
    4. On the Assignments page, assign the profile to the device groups that need this trust.
      This is typically the same group that receives the Forcepoint app.
    5. Click Review + create.
  4. Verify the certificate on the endpoint.
    Once the profile syncs to an enrolled macOS endpoint, confirm that the certificate landed in the System keychain and is trusted:
    security find-certificate -a -c "Your Root CA Common Name" /Library/Keychains/System.keychain
    Alternatively, check visually in Keychain Access > System > Certificates, and confirm that the certificate shows a blue checkmark with no red untrusted warning when you double-click it.