Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Configure Skyhigh Mobile Client for iOS Device

  1. Last updated
  2. Save as PDF

The Skyhigh Mobile Client for Mobile application enables end users to securely access the Internet and private applications from iOS devices. When end users access websites or private applications, the traffic is forwarded to the Skyhigh SWG (Cloud & On-Prem) for policy enforcement before it is forwarded to the actual website or private application.

NOTES: 

  • This topic is intended for MDM administrators who manage end users' iOS devices via the Skyhigh Mobile Client app. 
  • Skyhigh recommends creating a new user group and applying all relevant policies and configurations to the group. Once the Skyhigh Mobile Clientsetup and deployment are complete, MDM administrators can add new users to the group.
  • The recommended iOS version for installing the Skyhigh Mobile Client on iOS devices is 16 or higher.

Prerequisites 

Generate a self-signed certificate authority(CA) and use this file to generate a user identity(.p12) file. Upload the CA file to the Skyhigh UI. Download the customer Tenant CA certificate from the Skyhigh UI.

  • MDM Setup: Create a VPN profile along with a user identity(.p12) file and  Customer tenant CA certificate and push it directly to the iOS devices using MDM. Supports two configurations:
    • mobile.skyhigh.cloud: This redirects all traffic (Internet traffic and Private traffic) from the device to the cloud. 
    • pa-mobile.skyhigh.cloud: This redirects only Private app traffic to the cloud. The isolate feature is not supported with this config.
  • BYOD Setup: Share the Customer tenant CA certificate and upload a user identity (.p12) file to the user. The user has to install the CA certificate and trust in the device settings. The user has to install the app and upload p12 file which creates VPN.

Set Up iOS Device to Access Private Applications 

To enable secure access to private applications, you must configure your iOS device with the required certificates and VPN profile. The setup ensures traffic from your device is authenticated and securely tunneled through the Skyhigh Security Service.

Follow the steps below to generate and install certificates, upload them to the Skyhigh Security UI, and configure the VPN profile for seamless connectivity:

Generate Certificate Authority (CA) and User Identity (.p12) certificates

Create a self-signed CA file and use the same file to generate the User Identity files and sign those. 

NOTE: You can create one user identity file per user or device.

▼ Generate Certificates using XCA tool

You can generate the certificate using the XCA tool. 

  1. Download and install the XCA 2.4.0 tool. 
  2. Create a New Database, go to File  > New Database, and enter the password to save it.

Picture1.png

  1. Click the Certificates tab. 

Picture2.png

  1. Click New Certificate. 

Picture3.png

  1. Select Create a self signed certificate as the signing option. 

 

  1. Select Signature algorithm as SHA384. 

Picture5.png

  1. Select Template for the new certificate as [default] CA.

Picture6.png

  1. Click Apply extensions and Apply subject.

Picture7.png

  1. Click the Subject tab.

Picture8.png

  1. Enter Internal Name and commonName.

Picture9.png

  1. Click Generate a new key.

Picture10.png

  1. Select keytype as RSA and Keysize as 4096 bit.

Picture11_1.png

  1. Click Create.

Picture12.png

Key created message window appears. 

Picture13.png

  1. Go to the Extension tab and retain all the settings as is.

Picture14.png 

  1. Go to the Key Usage tab and retain all the settings as is.

Picture15.png

  1. Go to the Netscape tab and remove any selected options.

Picture16.png

  1. Go to the Advanced tab and review all the information. 

Picture17.png

  1. Click OK to create the CA certificate.

Picture18.png

  1. Click the Certificates tab. 

Picture2.png

  1. Select the recently created root_CA certificate.

Screenshot 2023-12-12.png

  1. Click New Certificate. 

Screenshot 2023-12-12_1.png

  1. Select the previously created CA(root_CA) certificate as the signing option. 

Picture21.png

  1. Select Signature algorithm as SHA384. 

Picture23.png

  1. Select the template for the new certificate as [default] TLS_client or [default] HTTPS_client.

Picture24.png

  1. Click Apply extensions and Apply subject.

Picture25.png

  1. Click the Subject tab, enter Internal Name and commonName. Make sure the file name is the same as the common Name. 

Picture26.png

  1. Click Generate a new key.

Picture27.png

  1. Select keytype as RSA and Keysize as 4096 bit.

Picture28.png

  1. Click Create.

Picture29.png

The key created message window appears. 

Picture30.png

  1. Go to the Extension tab. Select x509v3 basic Constraints type as Not defined and uncheck the Critical option. 

Picture31.png

  1. Select Key identifier as x509v3 Authority key Identifier.

Picture32.png

  1. Click Edit in the Select X509v3 Subject Alternative Name option. 

Picture33.png

  1. Enable the Copy Common Name setting and click Apply. 

NOTE: If Copy common name is not available, then manually enter the DNS:user1”(user1 as the common name of the client certificate added in step 26) in the X509v3 Subject Alternative Name field.

Picture33_1.png

Picture34.png

  1. Go to Key Usage tab, select options from the list as per the image below. 

Picture35.png

  1. Go to the Netscape tab and remove any selected options.

Picture16.png

  1. Go to the Advanced tab and review all the information. 

Picture37.png

  1. Click OK to create the CA certificate.

Picture38.png

  1. Select CA certificate and click Export.

38.png

  1. Select File Location and Export Format as PEM + Key (*.pem) for CA certificate. Click OK to save the file.

Picture41.png

  1. Select Client certificate(user1) and click Export.

39.png

  1. Select File Location and Export Format as PEM + Key (*.pem) for client certificate. Click OK to save the file.

Picture42.png

  1. Select Client certificate(user1) and click Export.

39.png

  1. Select File Location and Export Format as PKCS #12 chain (*.pfx) for the client certificate. Click OK to save the file. Make sure the file name is the same as the common Name.

Picture43.png

  1. Enter the Password and select Ok to save the file.

Picture44.png

  1. Go to the file location and open CA and Client file in any text editor. Verify only certificate part is available in the file. remove extra information, if any. 

Picture45.png

Picture46.png

  1. Rename Client file (user1) .pfx file as .p12 file.

Picture47.png

Upload CA certificate generated to the Skyhigh Security UI

 Upload the CA certificate generated in Step 1 to the Skyhigh Security UI.

NOTE: After this step, wait for 30-40 minutes before connecting VPN

  1. Go to Settings > Infrastructure > Web Gateway Setup.

    1.png
     
  2. Click Configure on the Skyhigh Mobile Cloud Security setting.

    2.png
     
  3. Click Upload and select the custom CA certificate.

NOTE: supported certificate formats are DER, PEM, CRT, and CER.

3.png

  1. Specify the User name and an optional User Group in the User Identity certificates. 

    4.png
     
  1. Click Save. 

    5.png
     
  1. Click Upload & Test and upload the User identity file with format as .cer, .crt, .pem or .der to validate the CA and user Identity file.

    6.png
     
  1. Click Save to save the configuration. 

    7.png
     
  1. Click Publish to apply the changes. 
Download Tenant Customer CA from Skyhigh UI 
  1. Go to Policy > Web Policy > Feature Configuration

    8.png
     
  1. Select HTTPS connections > Customer CA.

    9.png
     
  1. Select Customer CA and click Export to download the Customer CA file.

    10.png
  2. Share this Customer CA certificate with the user if selecting Manual VPN config. 
Download and Install Skyhigh Security Certificate in Mobile

Download the certificate using the link and share this certificate to install on the mobile device. 

  1. Download this certificate on your mobile device.
  2. Once it is downloaded, it will be available in Settings > Generic > VPN & Device management

  1. Select the certificate and tap Install.

  1. Enter the passcode and tap Install.

  1. After install, go to Settings > General > About > Certifcate Trust Settings

  1. Ensure that the certificate is installed and switch on the certificate, and tap continue to enable it.

Download Root Certificates and Install
  1. Download the certificate using this link. 
  2. To install the certificate, navigate to Settings > General > VPN & Device Management.

    The downloaded certificate appears on the VPN & Device Management screen. 
    Tap on Sectigo Public Server Authentication CA OV R36 certificate. 

    11.png

    Tap Install on the Install profile screen. 

    12.png

    Tap Install on the Installing Profile screen. 

    13.png

    Tap Done once installation is completed. 

    14.png

    Screenshot 2025-07-11 at 5.10.51 PM.png

NOTE: For iOS 17.4 and iPadOS 17.4 or later, use only the Sectigo Public Server Authentication CA OV R36 certificate. For earlier iOS versions, use both the Sectigo Public Server Authentication Root R46 and Sectigo Public Server Authentication CA OV R36 certificates.

  1. Download the Sectigo Public Server Authentication Root R46 certificate using this link.
  2. To install the certificate, navigate to Settings > General > VPN & Device Management.

    The downloaded certificate appears on the VPN & Device Management screen. 
    Tap on Sectigo Public Server Authentication Root R46 certificate. 



    Tap Install on the Install profile screen. 



    Tap Install on the Installing Profile screen. 



    The certificate installation is complete. 

     
  3. Go to Settings > General > About > Certificate Trust Settings > Toggle on ENABLE FULL TRUST FOR ROOT CERTIFICATE. 

Configure VPN profile
▼ MDM Configuration

Prerequisite: iPhone/iPad is already enrolled in the Intune portal. 

Admin has to create VPN profile along with generated user identity file(.p12) and downloaded Tenant customer CA certificate using Apple Configurator and push the VPN profile to the enrolled device. Admin has to create custom Line-of-business app using the IPA file shared and push the app to the enrolled device. Users should ensure that this configuration exists on the iOS device.

a. Create a VPN profile using the Apple configurator:

  1. Download Apple Configurator from the Mac Appstore.
  2. Click on File > New Profile.
  3. Go to General and enter a Name.

    a.png
     
  4. Go to Certificates and click Configure.

    b.png
     
  1. Select User Identity(.p12) file generated and enter the password.

    c.png
     
  2. Rename Tenant Customer CA(certificate_authority.pem) downloaded from the Skyhigh tenant to certificate_authority.crt.
  3. Click clipboard_e4d269edf9b33a4f96abddaa7d2c36ec6.png the icon in Certificates, select the Tenant Customer CA(certificate_authority.crt) file, and the Sertigo Public Server Authenticate CA OV R36 file. To download the Sertigo Public Server Authenticate CA OV R36 certificate file, see Download the Intermediate CA certificate and Install section. 

    d.png
     
  1. Go to the VPN settings and click Configure.

    e.png
     
  1. Enter the values as mentioned below:
  • Connection Name. Enter a name.
  • Connection Type. IKEv2.
    • To enable Always ON VPN, click on the check box. Always-ON VPN works only on the supervised devices.
      f.png
  • Server. mobile.skyhigh.cloud
  • Remote Identifier. 

    •  mobile.skyhigh.cloud or pa-mobile.skyhigh.cloud: 

      NOTE: When you create a mobileconfig file, it adds the following key-value pair which causes certificate installation failure. Delete this key pair to make the certificate work.

      Open the .mobileconfig file in any TextEdit and delete the below key and values.

      <key>DNS</key>
      <dict>
      <key>SupplementalMatchDomainsNoSearch</key>
      <integer>0</integer>
      </dict>

  • Local Identifier.  Copy the common name of the User identity file that appeared in Certificates(Eg: user2)

    g.png

  •  Machine Authentication. Select Certificate in the drop-down.

  • Identity Certificate. Select the user identity(.p12) file.

    h.png

  • Select Enable EAP

    clipboard_e06b6c0a285832bae6d7603d3669fb1dc.png

  • EAP Authentication. Select Certificate in the dropdown.

b. Push VPN configuration to the device using MDM:

This provides the configuration flow of pushing VPN profile to mobile device from Intune MDM (Mobile Device Management).

Creation of custom VPN Profile:

  1. Login to the Intune MDM account using the link. 

  1. Make sure your device appears in the Devices -> iOS/iPadOS when you log in. 

    1.1 - app.png
     
  2. Go to Devices > Configuration > Create.
  3. Click New Policy to create a new VPN configuration.

    1- app.png
     
  4. Select Platform as iOS/iPadOS.
  5. Select Profile type as Templates.
  6. Select the Template name as Custom.

    2-app.png
    Once Profile Type is selected as Custom, a window appears to upload the Apple Configurator profile file.
     
  7. Click Create. 

    2.1-app.png
     
  8. Under the Basics tab, enter Name and Description.

    3-app.png
     
  9. Click Next.

    4-app.png
     
  10. Under the Configuration settings tab, enter the Configuration profile name and upload .mobileconfig file created using Apple Configurator 2. 

    5-app.png
     
  11. Click Next. 

    6-app.png
     
  12. Under the Assignments tab, select your device group and click Next.

    7-app.png
     
  13. Under the Review + create tab, review the profile and click Create to create the VPN configuration profile.

    8-app.png

    Once the profile is assigned to the respective group, MDM takes some time to push the profile to the respective devices. 

c. Push Skyhigh Mobile Client App ipa to mobile devices:

  1. Go to Apps > iOS/iPadOS > click Create. 

    2025-09-25_15-31-42_1.png
  2. Select App type as iOS store app.

    2025-09-25_15-32-25_1.png
  3. Under the App information tab, click Select app.
    In the search bar, enter and select Skyhigh Client. 

    2025-09-25_15-34-25_22.png
     
  4. Under the App information tab, enter the Publisher name and click Next.

    2025-09-25_15-35-32.png
     
  5. Under the Assignments tab, select the required device group and click Next.

    2025-09-25_15-36-04_12.png
     
  6. Under the Review + create tab, review the app information and click Create.

    2025-09-25_15-37-01_1.png
     
  7. Verify the app created.

    7.webp

    Once the app is created, MDM takes some time to push the app to the respective device. 

NOTE: To enable the factory reset option using Intune, see Enable Factory Reset for Skyhigh Mobile Client App. 

NOTE: To make Microsoft Teams calls, add microsoft.com, live.com, skype.com in Policy > Web Policy > Policy > Global Bypass> Domains Bypass. 

TIP: For details about Skyhigh Mobile Client App installation and troubleshooting, see Skyhigh Mobile Client App for iOS Devices.

 

 

▼ Manual Configuration
Install the Tenant customer CA in the iOS device

Note: The iOS device should have a passcode to install and trust a CA certificate.

  1. Export the Tenant customer CA to device using Airdrop or mail

Once Tenant Customer CA is downloaded, it will be available in the device settings

  1. Go to device Settings > General > VPN & Device mangement.

  2. Tap the certificate and tap Install.


     
  3. Enter the passcode and tap Install.


     
  4. Profile installed message confirms that certificate is installed correctly.


     
  5. Go to settings > General > About > Certificate Trust settings, verify the Tenant Customer CA and enable the certificate switch. 


     
  6. Click Continue to trust the certificate.

    2025-09-25_13-01-19.png

 

  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Article type
    Topic
  2. Tags
    1. PA iOS
    2. Private Access iOS devices
    3. ZTNA iOS devices