{% extends "base.html" %}
{% block title %}Help — Certificate Portal{% endblock %}
{% block content %}
<article class="card prose">
  <h1>Help</h1>
  <p>Signed in as <strong>{{ user.username }}</strong>.</p>

  <h2>What this portal does</h2>
  <ol>
    <li>You sign in with your organization SSO (OpenID Connect).</li>
    <li>The portal looks up your Active Directory account and Windows SID.</li>
    <li>It generates an RSA key <em>on this server</em>, builds a certificate request, and submits it to Active Directory Certificate Services Web Enrollment (<code>certsrv</code>).</li>
    <li>The issued certificate and private key are packed into a PKCS#12, placed inside an Apple <code>.mobileconfig</code>, and that profile is cryptographically signed.</li>
    <li>Your device installs the profile. It never talks to the CA.</li>
  </ol>

  <h2>Private key on the server</h2>
  <p>
    Unlike SCEP, the key is not generated on the phone. It exists in the portal’s
    memory until the download finishes, then it is discarded and is not written
    to disk. That tradeoff is commonly accepted for user Wi-Fi certificates.
    Do not use this portal for keys that must never leave the device.
  </p>

  <h2>Install on iPhone or iPad</h2>
  <ol>
    <li>Tap <strong>Download certificate profile</strong> on the home page.</li>
    <li>Open the <strong>Settings</strong> app. A profile download notice appears near the top.</li>
    <li>Tap the profile, then <strong>Install</strong>. Authenticate with Face ID, Touch ID, or your passcode.</li>
    <li>The PKCS#12 import password is inside the signed profile; iOS applies it automatically.</li>
  </ol>

  <h2>Install on Mac</h2>
  <ol>
    <li>Download the <code>.mobileconfig</code> file.</li>
    <li>Open it from Downloads (or double-click in Finder).</li>
    <li>System Settings → <strong>Device Management</strong> (or Profiles) → install the profile.</li>
    <li>If the profile is signed by an identity your Mac already trusts, it shows as verified. If not, macOS still lets you install it after a warning.</li>
  </ol>

  <h2>If download fails</h2>
  <ul>
    <li><strong>No Active Directory user</strong> — your SSO name did not match <code>userPrincipalName</code> or <code>mail</code>.</li>
    <li><strong>Not in the required group</strong> — enrollment is limited to a group the administrator configured.</li>
    <li><strong>CA denied or pending</strong> — the certificate template may require manager approval, or the portal account may lack Enroll permission.</li>
  </ul>
  <p>Operators: see the <code>docs/</code> folder in the cert-portal repository (architecture, setup, AD CS, profile signing, security).</p>
</article>
{% endblock %}