Store the private and public key(s) only in the keychain
Computer Configuration > Policies > Centrify Settings > Mac OS X Settings > Security & Privacy > Public Key Policies > Store the private and public key(s) only in the keychain
Enable this group policy to store the auto-enrollment key(s) only in the keychain.
User certificate auto-enrollment always uses the Keychain and is not controlled by any Group Policy.
Note: 802.1X profiles installed through the "Mac OSX Settings -> 802.1X Settings" Group Policies will no longer be signed if this GP is enabled before profiles are installed.