Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Skyhigh Mobile Client for iOS Devices

  1. Last updated
  2. Save as PDF

The Skyhigh Client for Mobile application enables end users to securely access the Internet and private applications from iOS devices. When end users access websites or private applications, the traffic is forwarded to the Skyhigh SWG (Cloud & On-Prem) for policy enforcement before it is forwarded to the actual website or private application.

NOTES: 

  • This topic is intended for MDM administrators who manage end users' iOS devices via the Skyhigh Client app. 
  • Skyhigh recommends creating a new user group and applying all relevant policies and configurations to the group. Once the Skyhigh Client setup and deployment are complete, MDM administrators can add new users to the group.
  • The recommended iOS version for installing the Skyhigh Client on iOS devices is 16 or higher.

Prerequisites 

Generate a self-signed certificate authority(CA) and use this file to generate a user identity(.p12) file. Upload the CA file to the Skyhigh UI. Download the customer Tenant CA certificate from the Skyhigh UI.

  • MDM Setup: Create a VPN profile along with a user identity(.p12) file and  Customer tenant CA certificate and push it directly to the iOS devices using MDM. 
  • BYOD Setup: Share the Customer tenant CA certificate and upload a user identity (.p12) file to the user. The user has to install the CA certificate and trust in the device settings. The user has to install the app and upload p12 file which creates VPN.
Generate Certificate Authority (CA) and User Identity (.p12) certificates

Create a self-signed CA file and use the same file to generate the User Identity files and sign those. 

NOTE: You can create one user identity file per user or device.

▼ Generate Certificates using XCA tool

You can generate the certificate using the XCA tool. 

  1. Download and install the XCA 2.4.0 tool. 
  2. Create a New Database, go to File  > New Database, and enter the password to save it.

Picture1.png

  1. Click the Certificates tab. 

Picture2.png

  1. Click New Certificate. 

Picture3.png

  1. Select Create a self signed certificate as the signing option. 

12.png

  1. Select Signature algorithm as SHA384. 

Picture5.png

  1. Select Template for the new certificate as [default] CA.

Picture6.png

  1. Click Apply extensions and Apply subject.

Picture7.png

  1. Click the Subject tab.

Picture8.png

  1. Enter Internal Name and commonName.

Picture9.png

  1. Click Generate a new key.

Picture10.png

  1. Select keytype as RSA and Keysize as 4096 bit.

Picture11_1.png

  1. Click Create.

Picture12.png

Key created message window appears. 

Picture13.png

  1. Go to the Extension tab and retain all the settings as is.

Picture14.png 

  1. Go to the Key Usage tab and retain all the settings as is.

Picture15.png

  1. Go to the Netscape tab and remove any selected options.

Picture16.png

  1. Go to the Advanced tab and review all the information. 

Picture17.png

  1. Click OK to create the CA certificate.

Picture18.png

  1. Click the Certificates tab. 

Picture2.png

  1. Select the recently created root_CA certificate.

Screenshot 2023-12-12.png

  1. Click New Certificate. 

Screenshot 2023-12-12_1.png

  1. Select the previously created CA(root_CA) certificate as the signing option. 

Picture21.png

  1. Select Signature algorithm as SHA384. 

Picture23.png

  1. Select the template for the new certificate as [default] TLS_client or [default] HTTPS_client.

Picture24.png

  1. Click Apply extensions and Apply subject.

Picture25.png

  1. Click the Subject tab, enter Internal Name and commonName. Make sure the file name is the same as the common Name. 

Picture26.png

  1. Click Generate a new key.

Picture27.png

  1. Select keytype as RSA and Keysize as 4096 bit.

Picture28.png

  1. Click Create.

Picture29.png

The key created message window appears. 

Picture30.png

  1. Go to the Extension tab. Select x509v3 basic Constraints type as Not defined and uncheck the Critical option. 

Picture31.png

  1. Select Key identifier as x509v3 Authority key Identifier.

Picture32.png

  1. Click Edit in the Select X509v3 Subject Alternative Name option. 

Picture33.png

  1. Enable the Copy Common Name setting and click Apply. 

NOTE: If Copy common name is not available, then manually enter the DNS:user1”(user1 as the common name of the client certificate added in step 26) in the X509v3 Subject Alternative Name field.

Picture33_1.png

Picture34.png

  1. Go to Key Usage tab, select options from the list as per the image below. 

Picture35.png

  1. Go to the Netscape tab and remove any selected options.

Picture16.png

  1. Go to the Advanced tab and review all the information. 

Picture37.png

  1. Click OK to create the CA certificate.

Picture38.png

  1. Select CA certificate and click Export.

38.png

  1. Select File Location and Export Format as PEM + Key (*.pem) for CA certificate. Click OK to save the file.

Picture41.png

  1. Select Client certificate(user1) and click Export.

39.png

  1. Select File Location and Export Format as PEM + Key (*.pem) for client certificate. Click OK to save the file.

Picture42.png

  1. Select Client certificate(user1) and click Export.

39.png

  1. Select File Location and Export Format as PKCS #12 chain (*.pfx) for the client certificate. Click OK to save the file. Make sure the file name is the same as the common Name.

Picture43.png

  1. Enter the Password and select Ok to save the file.

Picture44.png

  1. Go to the file location and open CA and Client file in any text editor. Verify only certificate part is available in the file. remove extra information, if any. 

Picture45.png

Picture46.png

  1. Rename Client file (user1) .pfx file as .p12 file.

Picture47.png

Upload CA certificate generated to the Skyhigh Security UI

 Upload the CA certificate generated in Step 1 to the Skyhigh Security UI.

NOTE: After this step, wait for 30-40 minutes before connecting VPN

  1. Go to Settings > Infrastructure > Web Gateway Setup.

Screenshot (359).png

  1. Click Configure on the Skyhigh Mobile Cloud Security setting.

Screenshot (360).png

  1. Click Upload and select the custom CA certificate.

NOTE: supported certificate formats are DER, PEM, CRT, and CER.

Screenshot (362).png

  1. Specify the User name and an optional User Group in the User Identity certificates and click 

Screenshot (363).png

  1. Click Save. 

Screenshot (363_1.png

  1. Click Upload & Test and upload the User identity file with format as .cer, .crt, .pem or .der to validate the CA and user Identity file.

Screenshot (365).png

  1. Click Save to save the configuration. 

Screenshot (366).png

  1. Click Publish to apply the changes. 
Download Tenant Customer CA from Skyhigh UI 
  1. Go to Policy > Web Policy > Feature Configuration

Screenshot (368).png

  1. Select HTTPS connections > Customer CA.

Screenshot (370).png

  1. Select Customer CA and click Export to download the Customer CA file.

Screenshot (371)_1.png

  1. Share this Customer CA certificate to the user if selecting Manual VPN config. 
Download Root Certificates and Install
  1. Download the certificate using this link. 
  2. To install the certificate, navigate to Settings > General > VPN & Device Management.

    The downloaded certificate appears on the VPN & Device Management screen. 
    Tap on Sectigo Public Server Authentication CA OV R36 certificate. 

    11.png

    Tap Install on the Install profile screen. 

    12.png

    Tap Install on the Installing Profile screen. 

    13.png

    Tap Done once installation is completed. 

    14.png

    Screenshot 2025-07-11 at 5.10.51 PM.png

NOTE: For iOS 17.4 and iPadOS 17.4, use only the Sectigo Public Server Authentication CA OV R36 certificate. For earlier iOS versions, use two certificates: Sectigo Public Server Authentication Root R46 and Sectigo Public Server Authentication CA OV R36.
 

  1. Download the Sectigo Public Server Authentication Root R46 certificate using this link.
  2. To install the certificate, navigate to Settings > General > VPN & Device Management.

    The downloaded certificate appears on the VPN & Device Management screen. 
    Tap on Sectigo Public Server Authentication Root R46 certificate. 

    Mobile 1.png

    Tap Install on the Install profile screen. 

    Mobile 2.png

    Tap Install on the Installing Profile screen. 

    Mobile 3.png

    The certificate installation is complete. 

     Mobile 4.png
  3. Go to Settings > General > About > Certificate Trust Settings > Toggle on ENABLE FULL TRUST FOR ROOT CERTIFICATE. 

    mobile 6.png

Setup Skyhigh Client App and Certificate Deployment using MDM 

Skyhigh Client App and Certificate Deployment 
▼ MDM Setup 

Prerequisite: iPhone/iPad is already enrolled in the Intune portal. 

Admin has to create VPN profile along with generated user identity file(.p12) and downloaded Tenant customer CA certificate using Apple Configurator and push the VPN profile to the enrolled device. Admin has to create custom Line-of-business app using the IPA file shared and push the app to the enrolled device. Users should ensure that this configuration exists on the iOS device.

a. Create a VPN profile using the Apple configurator:

  1. Download Apple Configurator from the Mac Appstore.
  2. Click on File > New Profile.
  3. Navigate to General and add any name.

clipboard_e55a5417e6f246e8f22aa8a759f8783fb.png

  1. Navigate to Certificates and click Configure.

clipboard_e7b0347c262954a9929990d2eefcf0165.png

  1. Select User Identity(.p12) file generated and enter the password.

clipboard_e7204a1ef36ede18bce150f123dd33c72.png

  1. Rename Tenant Customer CA(certificate_authority.pem) downloaded from the Skyhigh tenant to certificate_authority.crt.
  2. Click  + icon in Certificates, select the Tenant Customer CA(certificate_authority.crt) file, and the Sertigo Public Server Authenticate CA OV R36 file. To download the Sertigo Public Server Authenticate CA OV R36 certificate file, see Download the Intermediate CA certificate and Install section. 

Screenshot 2025-07-11 at 5.59.01 PM.png

  1. Navigate to VPN settings and click Configure.

clipboard_e0da9fa17747f2654f6fd946b0cfe0c0f.png

  1. Enter the values as mentioned below:
  • Connection Name: Any random name.
  • Connection Type: IKEv2.
    • To enable Always ON VPN, click on the check box. Always-ON VPN works only on the supervised devices.
      Screenshot 2024-11-04 at 4.03.13 PM.png
  • Server: mobile.skyhigh.cloud
  • Remote Identifier: 

    •  mobile.skyhigh.cloud: 

      NOTE: When you create a mobileconfig file, it adds the following key-value pair which causes certificate installation failure. Delete this key pair to make the certificate work.

      Open the .mobileconfig file in any TextEdit and delete the below key and values.

      <key>DNS</key>
      <dict>
      <key>SupplementalMatchDomainsNoSearch</key>
      <integer>0</integer>
      </dict>

  • Local Identifier:  Copy the common name of the User identity file that appeared in Certificates(Eg: user2)
    clipboard_e58f1701aa8046aa3014639ff2918428f.png

  •  Machine Authentication: Select Certificate in the drop-down.

  • Identity Certificate: Select the user identity(.p12) file.
    clipboard_ec6c9c3b9331b0bfb72723211d0ba8f0f.png

  • Select Enable EAP
    clipboard_e06b6c0a285832bae6d7603d3669fb1dc.png

  • EAP Authentication: Select Certificate in the dropdown.

b. Push VPN configuration to the device using MDM:

This provides the configuration flow of pushing VPN profile to mobile device from Intune MDM (Mobile Device Management).

Creation of custom VPN Profile:

  1. Login to the Intune MDM account using the link. 

  1. Make sure your device appears in the Devices -> iOS/iPadOS when you log in. 

2.png

  1. Go to Devices > Configuration > Create.
  2. Click New Policy to create a new VPN configuration.

3.png

  1. Select Platform as iOS/iPadOS.
  2. Select Profile type as Templates.
  3. Select the Template name as Custom.

4.png
 

  1. Once Profile Type is selected as Custom, a window will be opened to upload the Apple Configurator profile file.
  2. Enter Name and Description and click Next.

5.png
 

  1. Enter the Configuration profile name and upload .mobileconfig file created using Apple Configurator 2 and click Next.

6.png

  1. Select your devices group in Assignments > Included group and click Next.

7.png
 

  1. Review the profile and click Create to create the VPN configuration profile.

8.png

 

  1. Once the profile is assigned to the respective group, MDM takes some time to push the profile to the respective devices.

c. Push Skyhigh Client App ipa to mobile devices:

  1. Go to Apps -> iOS/iPadOS and click Create. 

1.webp
 

  1. Select App Type as Line-of-business app.

2.webp
 

  1. In the App information page, click Select app package file.

3.webp

  1. Enter the Publisher name and select Next.

4.webp

  1. Select the required device group in the Assignment section and click Next.

5.webp
 

  1. Review the app information and click Create.

    6.webp

 

  1. Verify the app created.

    7.webp

 

  1. Once the app is created, MDM takes some time to push the app to the respective device. 

NOTE: To make Microsoft Teams calls, add microsoft.com, live.com, skype.com in Policy > Web Policy > Policy > Global Bypass> Domains Bypass. 

For details about Skyhigh Client App installation and troubleshooting, see Skyhigh Client App for iOS Devices.

 

  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Article type
    Topic
  2. Tags
    1. PA iOS
    2. Private Access iOS devices
    3. ZTNA iOS devices