I am in enterprise IT and need to develop a process for scripting the creation of a Certificate Signing Request for the machine. There must also be no MDM dependences. I support our CA infrastructure but come from a Windows background; however, I am familiar with Openssl. This is for a machine client authentication certificate that will be used by an application to ensure the device is corporate owned; we are using this with Windows today so am not looking for alternative solutions. The KeychainAccess CSR wizard seems more for users, requiring an email address which is incompatible with the requirement. Ultimately, I need a scriptable solution that will create a CSR based on the machine name. A tech will then upload the CSR, obtain a response via an internal process then use a script to install that response. When using Openssl to make the request, where is the correct place to store the private key for the machine? And how do I install the response so it ties with the key and shows up in Keychain. Finally, I have to tell Keychain to allow my app access to it. Thanks for any help. I am hoping someone has solved this problem before.
MacBook Pro, v12.6.2 with arM64 CPU