Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

5 points

iPhone & certificate enrollment OTA via SCEP

Hello there,

We're looking at evaluating iPhones at my business, and a key part of this is working out how out an enterprise deployment would work, with devices numbering in the 1000s.

Apple are pushing hard to spruike the perceived ease which with iPhone profiles can be deployed with ease, and how certificate management overheads are reduced through the use of SCEP.

Well, I can say that I have just invested a lot of time and effort searching the web for any whitepapers or general documentation around how iPhones and SCEP integration might work, and I can safely say there is basically no practical documentation available (take note apple, a link to SCEP RFC does not count as a useful documentation!).

So, I have setup a standalone lab environment, and have Microsoft certificate services working on a Windows 2008 server (enterprise Root CA), with the Network Deployment Enrollment Services add-on configured... this is Microsoft's version of SCEP. I have deployed a new custom certificate template setup for client-auth, and I am succesfully getting challenge responses and thumbprints via the web-interface.

I then populate the thumbprint and the challenge into the iPhone configuration utility, but when I go to install the profile on my phone, it just tried to generate the key, then seems to bomb citing "Profile failed to install".

I'm not getting much more in the way of details or logs.

1) Has anyone had real world experience in setting iPhones and SCEP up?
2) Can anyone confirm which exact settings I'm supposed to populate in the SCEP section of the iPCU?

I have populated the following fields:

- (URL) http://[hostname]/certsrv/mscep_admin/mscep.dll
- (Name) [Name of the Root Cert]
- (Subject) [I have left this field blank?]
- (Challenge) [challege as provided by the SCEP web interface]
- (Key size) 2048 (matches the cert template)
- (Use as digital signature) is not checked
- (Use as key encipherment) is not checked
- (Fingerprint) [is populated from SCEP web interface]

What am I missing? Does apple have anything in the way of useful documentation in this space?

Regards, James.

3GS, Windows XP

Posted on Oct 14, 2009 5:45 AM

43 replies

Nov 10, 2009 5:06 AM in response to who.mobile

Hallo

On CA with RA like Microsoft CA is, GetCACert receive a application/x-x509-ca-ra-cert, which is a p7b certificate with 3 cert (1xRoot, 2xRA). In this case leave the fingerprint blank.

* (URL) http://hostname/certsrv/mscep/mscep.dll
* (Name) Name of the Root Cert
* (Subject) CN=iPhone (MS CA require a subject)
* (Challenge) challenge as provided by the SCEP web interface
* (Key size) 2048 or 1024, it works with both settings
* (Use as digital signature) is not checked
* (Use as key encipherment) is not checked
* (Fingerprint) leave this blank

With this settings, SCEP works fine.

Message was edited by: daidaloss

Nov 10, 2009 7:15 AM in response to daidaloss

Hallo again,

here is an update of the entry above...

we started with the same problems. But:
On CA with RA like Microsoft CA is, GetCACert receive a application/x-x509-ca-ra-cert, which is a p7b certificate with 3 cert (1xRoot, 2xRA). In this case leave the fingerprint blank.

* (URL) http://hostname/certsrv/mscep/mscep.dll
* (Name) Name of the Root Cert
* (Subject) CN=iPhone (MS CA require a subject)
* (Challenge) challenge as provided by the SCEP web interface
* (Key size) 2048 or 1024, it works with both settings
* (Use as digital signature) is not checked
* (Use as key encipherment) is not checked
* (Fingerprint) leave this blank

With this settings, SCEP is working fine.
We don't know, if the empty fingerprint is a bug of the iPhone Configuration Utility or the iPhone. Or is it working as designed?

In our case it is working also with a CISCO CA (which responds to GetCACert with application/x-x509-ca-cert, only the root-certificate in cer-format).
The fingerprint can be set, left empty or even wrong.

Cap.me

Level 1

0 points

Nov 10, 2009 8:20 AM in response to froowstie

Unfortunately not. I have no mobileiron appliance. I'm trying to find what kind of signature IPCU is using in order to reproduce it with my own certificate.

...Anyone knows ? Dsig ? XML envelopped, detached ?

Regards,

Cap.me

Level 1

0 points

Nov 12, 2009 6:47 AM in response to daidaloss

Hi daidaloss ,

Did you sign your scep config file with IPCU or your CA ?

Thanks,

Regards,

Nov 13, 2009 12:27 AM in response to Cap.me

Hi,

Our profiles are signed with iCU.

But it doesn't matter even with signed or unsigned profile. You can modify every unsigned profile with Notepad.

You can distribute this profile with iCU or over http.

regards, Daidaloss

Message was edited by: daidaloss

Dec 17, 2009 8:34 AM in response to froowstie

I think the solution to the problem with getting SCEP working on an iPhone is to make sure that the Windows CA server it's pointing to auto-grants certificate requests.

Under Windows 2003 this is done using this registry setting:

HKEY LOCALMACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP\EnforcePassword

I have just tested this successfully in a lab.

jguillet

Level 1

0 points

Jan 7, 2010 10:58 AM in response to adam-appleuser

Has anyone gotten this to work yet? I've got my W2K8 PKI working and SCEP (Network Device Enrollment Service) is installed. Now what? The lack of documentation here is amazing.

Jan 22, 2010 2:08 AM in response to Cap.me

It appears iPCU generates its own keypair upon first start, and then manages to place its certificate into iPhones the first time they are tethered. This explains why an iPCU-signed profile is trusted by iPhones that have already been connected to this instance.
A signed profile is just a PKCS#7 binary-encoded file. You can generate them with 'openssl smime'.

Jan 25, 2010 4:06 PM in response to Nicolas Troiscentquatorze

I am having this same problem using Windows 2008 NDES. Can anyone confirm that the signing of the profile by the Enterprise CA will allow for this to be installed? There is no mention of how to use a different certificate to sign the profile in the deployment guide. There is limited debugging information on both sides of this request, so it is making it very hard to see what is going on.

More documentation would be helpful here, and it seems that someone Apple could help identify the source of this problem that so many people are having.

Jan 29, 2010 4:53 AM in response to Jonathan13

For what it's worth: an iPhone will blindly trust any mobileconfig file that is signed by something that relates to a root certificate it trusts, including free certificates delivered by Verisign without any sort of verification. I tried what is described here and it worked:

http://cryptopath.wordpress.com/2010/01/29/iphone-certificate-flaws/

Get a signature certificate Class 1 using a temporary e-mail address, sign your mobileconfigs with it, done.

Feb 22, 2010 3:40 PM in response to jguillet

Any luck figuring this out? I am in the same position. Server 2008 with NDES installed. Not sure where to go from here. All I want to do is have the phone a a certificate automatically. Please help.

jguillet

Level 1

0 points

Mar 3, 2010 8:52 AM in response to froowstie

I just completed a blog series, "*How to Securely Deploy iPhones with Exchange ActiveSync in the Enterprise*". This is a soup-to-nuts solution I've implemented for customers. Although it doesn't use SCEP, it also doesn't need it. I hope it helps you.

http://www.expta.com/2010/03/how-to-securely-deploy-iphones-with_03.html

Mar 3, 2010 12:04 PM in response to Nicolas Troiscentquatorze

would you be more specific because I could not generate them using 'openssl smime'. i would really appreciate your help. a command line example would be perfect.
thx

MidSpeck

Level 1

10 points

Mar 9, 2010 6:44 PM in response to filedeliver

@filedeliver,
Take a look at http://www.rootmanager.com/iphone-ota-configuration/iphone-ota-setup-with-signed -mobileconfig.html to answer your question about 'openssl smime'.

May 1, 2010 12:53 PM in response to hamiljockey

It works in my setup with win2008 and NDES.

One important thing to change is the maximum query string length in IIS. The iPhone SCEP GET request is longer than the default maxium in IIS 7. I changed it to 4096 and then everything works

iPhone & certificate enrollment OTA via SCEP