The CA certificate profile

Each enrolled Mac mints its own interception certificate authority, and the agent uploads that CA’s public certificate to the console. The MDM profile action on a device’s row (Devices page) downloads a .mobileconfig carrying that device’s CA as a trusted-certificate payload. Push it through your MDM and the trust lands in the admin domain — outside the employee’s reach, where removing it is an MDM-visible event. This is the trust upgrade described in CA trust tiers.

What’s inside

The device’s CA public certificate only. The private key never leaves that machine, and our backend is structurally incapable of holding it — so this profile cannot exist for any device that hasn’t uploaded its certificate, and it can never carry key material.

Rules of the road

Downloading is not installing. The device’s CA trust badge does not change when you download the profile — only when the device itself reports the installed trust on a later check-in. A badge that turned green on download would be claiming an enforcement nobody has performed yet.
The profile is specific to one Mac. Every device has its own CA — there is no fleet-wide certificate, deliberately: compromising one device’s CA compromises one device. Do not deploy one device’s profile broadly; it would trust a certificate that only benefits that machine.
Re-downloading is always safe. Profile identifiers are stable per device, so a re-push updates the installed profile in place instead of stacking a duplicate. An unchanged certificate produces a byte-identical profile.
A reinstalled device needs a fresh profile. Reinstalling the agent mints a new CA, which silently orphans any previously pushed profile — it still installs a certificate, just no longer the one the device is using. After a reinstall, re-download and re-push that device’s profile.
Every download is audited — who obtained which device’s CA, and when. Exporting a trust anchor is exactly the kind of action that needs a record.