Managed corporate access client

Native Windows and macOS clients with signed policy · update trust pinned to the issuing CA

What was built

Windows and macOS clients for corporate access, plus the policy panel behind them. The server signs policy with ECDSA P-256, the client checks it with an embedded key. Update trust is pinned to the issuing CA, not a thumbprint. Pin the thumbprint and one reissue kills updates fleet-wide. I keep machine data and the user profile apart. Panel login is a domain account, over Kerberos. Tests went from 31 to 175. All in production.

Stack

.NET 8Swift / AppKitWiX / MSImacOS pkgECDSA P-256Kerberos / SPNEGOAuthenticode

Other work