Using ACME certificates for TLS client authentication on macOS

Hello,

I'm trying to use a certificate provisioned through the com.apple.security.acme payload for TLS client authentication in Safari on macOS.

Provisioning the certificate via ACME using the device-attest-01 challenge is working fine and the signed certificate includes the Extended Key Usage: TLS Web Client Authentication.

Unfortunately on macOS in Safari I can't find a way to choose this identity when a server requests client authentication.

Using the same method works flawlessly on iOS. If a server requests client authentication Safari prompts the option to use the certificate and the connection to the web server succeeds as intended.

On macOS I have tried adding a com.apple.security.identitypreference payload to the profile, linking the certificate from the ACME payload to the domain name of a web server that requires client authentication, but that did not change the behavior in any way.

The following payload is used to request the certificate on both my MacBook and iPhone:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadDisplayName</key>
    <string>ACME Certificate Request</string>

    <key>PayloadIdentifier</key>
    <string>com.example.net.acmeprofile</string>

    <key>PayloadType</key>
    <string>Configuration</string>

    <key>PayloadUUID</key>
    <string>UUID-1111-1111-1111-111111111111</string>

    <key>PayloadVersion</key>
    <integer>1</integer>
    
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.apple.security.acme</string>

            <key>PayloadIdentifier</key>
            <string>com.example.net.acme</string>

            <key>PayloadUUID</key>
            <string>UUID-2222-2222-2222-222222222222</string>

            <key>PayloadVersion</key>
            <integer>1</integer>

            <key>DirectoryURL</key>
            <string>https://acme.example.net/acme/apple-acme/directory</string>

            <key>ClientIdentifier</key>
            <string>XXXXXXXXX</string>

            <key>KeyType</key>
            <string>ECSECPrimeRandom</string>

            <key>KeySize</key>
            <integer>256</integer>

            <key>UsageFlags</key>
            <integer>1</integer>

            <key>ExtendedKeyUsage</key>
            <array>
                <string>1.3.6.1.5.5.7.3.2</string>
            </array>

            <key>HardwareBound</key>
            <true/>
            
            <key>Attest</key>
            <true/>

            <key>AllowAllAppsAccess</key>
            <true/>

            <key>Subject</key>
            <array>
                <array>
                    <array>
                        <string>CN</string>
                        <string>XXXXXXXXX</string>
                    </array>
                </array>
            </array>
        </dict>
    </array>
</dict>
</plist>

And this is the identity payload I have added to the profile on macOS:

<key>PayloadType</key>
<string>com.apple.security.identitypreference</string>
 
<key>PayloadIdentifier</key>
<string>com.example.net.identitypreference</string>

<key>PayloadUUID</key>
<string>UUID-3333-3333-3333-3333333333333333</string>

<key>PayloadVersion</key>
<integer>1</integer>

<key>Name</key>
<string>mtls-endpoint.example.net</string>

<key>PayloadCertificateUUID</key>
<string>UUID-2222-2222-2222-222222222222</string>

Neither device is managed by an MDM service and they run macOS 26.6.1 and iOS 26.6 respectively.

Is there any additional configuration required on macOS to make an ACME-provisioned certificate available for client authentication in Safari?

Or is this simply the expected behavior, and client authentication requires a traditional certificate-key pair in the macOS Keychain?

Any help would be greatly appreciated!