json_schema: {
      "properties": {
          "AllowAllAppsAccess": {
              "default": false,
              "description": "Allow all apps to access the certificate in the keychain",
              "type": "boolean"
          },
          "CertServer": {
              "description": "Fully qualified host name of the Active Directory issuing CA.",
              "type": "string"
          },
          "CertTemplate": {
              "default": "User",
              "description": "Template Name as it appears in the General tab of the template\u2019s object in the Certificate Templates\u2019 Microsoft Management Console snap-in component.",
              "type": "string"
          },
          "CertificateAcquisitionMechanism": {
              "description": "Most commonly RPC. If using Web enrollment, HTTP.",
              "enum": [
                  "RPC",
                  "HTTP"
              ],
              "type": "string"
          },
          "CertificateAuthority": {
              "description": "Name of the CA. This value is determined from the Common Name (CN) of the Active Directory entry: CN=(your CA name), CN='Certification Authorities', CN='Public Key Services', CN='Services', or CN='Configuration', (your base Domain Name).",
              "type": "string"
          },
          "CertificateRenewalTimeInterval": {
              "default": 14,
              "description": "The number of days before the certificate expires at which to start showing the expiration notification",
              "type": "number"
          },
          "Description": {
              "description": "The description of the certificate request as shown in the certificate selector of other payloads such as VPN and Network",
              "type": "string"
          },
          "KeyIsExtractable": {
              "default": false,
              "description": "Allow admin to export private key from the keychain",
              "type": "boolean"
          },
          "Keysize": {
              "default": 2048,
              "description": "The RSA key size for the Certificate Signing Request (CSR).",
              "type": "number"
          },
          "Password": {
              "description": "The password with which to authenticate to the certificate server",
              "type": "string"
          },
          "PayloadDescription": {
              "default": "Requests an Active Directory certificate",
              "description": "Description of the payload",
              "type": "string"
          },
          "PayloadDisplayName": {
              "default": "AD Certificate",
              "description": "Name of the payload",
              "type": "string"
          },
          "PayloadIdentifier": {
              "default": "com.apple.ADCertificate.managed",
              "description": "A unique identifier for the payload, dot-delimited.  Usually root PayloadIdentifier+subidentifier",
              "type": "string"
          },
          "PayloadOrganization": {
              "description": "This value describes the issuing organization of the profile, as displayed to the user",
              "type": "string"
          },
          "PayloadType": {
              "default": "com.apple.ADCertificate.managed",
              "description": "The type of the payload, a reverse dns string",
              "type": "string"
          },
          "PayloadUUID": {
              "default": "",
              "description": "Unique identifier for the payload (format 01234567-89AB-CDEF-0123-456789ABCDEF)",
              "pattern": "^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$",
              "type": "string"
          },
          "PayloadVersion": {
              "default": 1,
              "description": "The version of the whole configuration profile.",
              "type": "number"
          },
          "PromptForCredentials": {
              "default": false,
              "description": "Prompt the user for credentials.  This setting is not supported for pushed profiles",
              "type": "boolean"
          },
          "UserName": {
              "description": "The user name with which to authenticate to the certificate server",
              "type": "string"
          }
      },
      "title": "com.apple.ADCertificate.managed",
      "type": "object"
  }