{"id":9747,"date":"2026-07-09T00:33:27","date_gmt":"2026-07-09T00:33:27","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=9747"},"modified":"2026-07-09T00:33:28","modified_gmt":"2026-07-09T00:33:28","slug":"meraki-cloud-pki","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/meraki-cloud-pki","title":{"rendered":"Meraki Cloud PKI"},"content":{"rendered":"\n

Azure Cloud PKI is now released; how do we hook Meraki AP to it? – Page 5 – Cisco Community<\/a><\/p>\n\n\n\n

Step-by-step walkthrough<\/strong> <\/p>\n\n\n\n

Part 1 – Microsoft Cloud PKI<\/strong> <\/p>\n\n\n\n

Note before starting: There is a tenant limit of 6 CA  <\/em> <\/p>\n\n\n\n

If you get it wrong, you do need to contact Microsoft Support to remove them so you can start again who are happy to help.<\/em> <\/p>\n\n\n\n

The setup of the?Microsoft Cloud PKI<\/a>?is really simple. With a few clicks we are ready to go. Within Microsoft Intune navigate to?Tenant administration > Cloud PKI and click on Create<\/strong>: <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Root CA Creation<\/strong> <\/p>\n\n\n\n

On the creation wizard fill in the name of the new Root<\/strong> CA <\/strong> <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Select the CA type:?Root CA<\/strong>?with a Validity period:?25 years<\/strong>.  <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Extended Key Usages: select<\/strong> as minimum Server Auth<\/strong> and Client Auth<\/strong>. But you can add more if you wish. <\/strong> <\/p>\n\n\n\n

Fill in all subject attributes<\/strong> for maximum compatibility <\/p>\n\n\n\n

O as \u201cyour company name\u201d <\/p>\n\n\n\n

OU as \u201cIT\u201d <\/p>\n\n\n\n

C as \u201c2 digit country code\u201d <\/p>\n\n\n\n

ST as \u201cyour state\u201d <\/p>\n\n\n\n

Locality as \u201cen-us\u201d or \u201cen-gb\u201d or \u201cen-au\u201d or just leave this one blank, no big deal. <\/p>\n\n\n\n

 
For the key size and algorithm, I\u2019ve chosen the strongest one?RSA-4096 and SHA-512  <\/strong> <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Then click next<\/strong>.  <\/p>\n\n\n\n

 Issuing CA Creation<\/strong> <\/p>\n\n\n\n

Let\u2019s proceed with the Issuing CA by doing basically the same again and using CA type?Issuing CA<\/strong>. We start with the name of the Issuing CA: <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Choose the CA type?Issuing CA<\/strong>? <\/p>\n\n\n\n

Select your newly created?Intune?<\/strong>based?Root CA<\/strong>.  
 
Validity period I chose the maximum of?10 years<\/strong> <\/p>\n\n\n\n

The Extended Key Usages (EKU) can be chosen based on the ones I\u2019ve added to the Root CA. 
 
Extended Key Usages: select as minimum Server Auth<\/strong> and Client Auth<\/strong>. But you can add more if you wish. <\/strong> <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Fill in the Subject attributes<\/strong> and the key size<\/strong> as per Root CA<\/strong>  <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Finally on the summary page, click on?Create<\/strong>: <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Now we are going to download the Root CA and Issuing CA certificate, as we want to deploy them later to our devices.  <\/p>\n\n\n\n

Click on the?Root CA, <\/strong>select properties<\/strong>?and then click on the Button?Download<\/strong>?to download the certificate. <\/p>\n\n\n\n

Repeat for the Issuing CA<\/strong> <\/p>\n\n\n\n

Also for the Issuing CA, copy\/save the SCEP URI<\/strong>, we need this in Part 3 <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n

Part 2 \u2013 Meraki SSID.<\/strong> <\/p>\n\n\n\n

Log in to Meraki and navigate to the Access Control page and select your desired SSID. <\/p>\n\n\n\n

Set SSID to Enabled<\/strong>  <\/p>\n\n\n\n

Under Security, select Enterprise with Local Auth<\/strong>  <\/p>\n\n\n\n

Certificate authentication Enabled<\/strong> <\/p>\n\n\n\n

Password authentication Disabled<\/strong> <\/p>\n\n\n\n

Download the IdenTrust Root CA cert and put it with your previously downloaded Root CA and Issuing CA certificates. You will deploy this to your devices later with Intune.  Here is a copy of it for convenience.<\/a> <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

LDAP set to Do not verify with LDAP<\/strong> <\/p>\n\n\n\n

OCSP set to Do not verify certificate with OCSP<\/strong> (at least until intune cloud PKI decides to support this function.) <\/p>\n\n\n\n

Upload the certificate of your Issuing CA<\/strong>. <\/p>\n\n\n\n

Part 3 \u2013 Intune device profiles for windows devices.<\/strong>   
(The home stretch)  Process is similar for IOS. <\/p>\n\n\n\n

We are going to deploy 5 profiles in this order: <\/p>\n\n\n\n