Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

5 points

iPhone & certificate enrollment OTA via SCEP

Hello there,

We're looking at evaluating iPhones at my business, and a key part of this is working out how out an enterprise deployment would work, with devices numbering in the 1000s.

Apple are pushing hard to spruike the perceived ease which with iPhone profiles can be deployed with ease, and how certificate management overheads are reduced through the use of SCEP.

Well, I can say that I have just invested a lot of time and effort searching the web for any whitepapers or general documentation around how iPhones and SCEP integration might work, and I can safely say there is basically no practical documentation available (take note apple, a link to SCEP RFC does not count as a useful documentation!).

So, I have setup a standalone lab environment, and have Microsoft certificate services working on a Windows 2008 server (enterprise Root CA), with the Network Deployment Enrollment Services add-on configured... this is Microsoft's version of SCEP. I have deployed a new custom certificate template setup for client-auth, and I am succesfully getting challenge responses and thumbprints via the web-interface.

I then populate the thumbprint and the challenge into the iPhone configuration utility, but when I go to install the profile on my phone, it just tried to generate the key, then seems to bomb citing "Profile failed to install".

I'm not getting much more in the way of details or logs.

1) Has anyone had real world experience in setting iPhones and SCEP up?
2) Can anyone confirm which exact settings I'm supposed to populate in the SCEP section of the iPCU?

I have populated the following fields:

- (URL) http://[hostname]/certsrv/mscep_admin/mscep.dll
- (Name) [Name of the Root Cert]
- (Subject) [I have left this field blank?]
- (Challenge) [challege as provided by the SCEP web interface]
- (Key size) 2048 (matches the cert template)
- (Use as digital signature) is not checked
- (Use as key encipherment) is not checked
- (Fingerprint) [is populated from SCEP web interface]

What am I missing? Does apple have anything in the way of useful documentation in this space?

Regards, James.

3GS, Windows XP

Posted on Oct 14, 2009 5:45 AM

43 replies

Jul 17, 2010 1:24 PM in response to mikael janers

I managed to set up a test environment and it's working fine now using OS 3.1.X, however whenever I try to use OS4 I get an error "A network error has occurred. The network connection was lost", has anybody tested the enrollment process using OS4?

Thanks in advance...

CW1828

Level 1

0 points

Jul 17, 2010 9:28 PM in response to emmanuel.aquino

I'm seeing the same exact behavior. When looking at the network traffic, it appears that OS4 isn't even attempting to send out a packet to enroll the certificate. If you look at the phone log, you'll see quite of error logging that seems to originate with the line:

"unknown lockdownd[18] <Error>: (0x403000) handle_connection: Could not receive internal message #3 from profiled. Killing connection"

Anyone have any luck with this or have a possible workaround?

nulp

Level 1

0 points

Aug 2, 2010 10:29 AM in response to CW1828

Hi, we were having the same problem, in our case it was caused by the GetCACaps operation that is not supported on Microsoft and that, apparently, iOS4 requires and answer from the CA/SCEP server and if no answer is received it fails with the "Network connection lost." error.

We posted all the info in our company's blog:
http://www.ipointsystems.com/blog/?p=183

Hope this helps you!

si.pki

Level 1

0 points

Aug 5, 2010 10:12 AM in response to who.mobile

Hey Matt.

I am evaluating MobileIron now, and I cannot seem to get a client authentication certificate to my iPad. I can get a device-based certificate just fine, but that certificate type is not what works for us. What is the certificate type you are using? How are you using it? Do you use it as an authentication mechanism? Or are you using something else to authenticate instead of the certificate?

If you don't feel comfortable disclosing your information on this forum, please feel free to email me or look me up. I work for KLA-Tencor.

Thanks,

pik10

Level 1

4 points

Jan 5, 2011 4:55 PM in response to froowstie

I get this error:
Pofile Failed to Install
The SCEP server configuration is not supported

I use cisco ca in my setup. Any ideas?

Matholl

Level 1

0 points

May 31, 2011 2:37 AM in response to pik10

Hello All,

For begenning, I 've read your post but I have difficulties understanding if the use of SCEP is mandatory in my case.

I'm trying to use the OTA mobileconfig to retrive the UDID of users, I made a mobileconfig and I manage to install it ont iDevice and after installing, it call my PHP script back but with no datas (in the GET, POST, Files variables) do I need to use SCEP to have datas in this answer ?

I made a test with a custom mobileconfig script calling back the "http://whatismyudid.com/device/enroll" and the datas appears so i think my mobileconfig file is working fine.

Thanks

Regards

Aug 24, 2011 10:40 AM in response to pik10

Hi pik10,

Were you able to fixed the issue with the Cisco CA?

I am assuming you have configured Cisco IOS PKI on a router, is this correct?

Thanks

Sep 15, 2011 5:02 PM in response to froowstie

Useful article on the Microsoft TechNet Blogs site about iPads / iPhones and talking to a Windows 2008 CA/NDES Server with SCEP.

http://blogs.technet.com/b/askds/archive/2010/11/22/ipad-iphone-certificate-issu ance.aspx

Cheers

Phil

Simon So

Level 1

0 points

Jan 2, 2013 10:29 AM in response to froowstie

Hi all,

Do you happen to know how to specify my configuration profile to bypass the GetCACaps?

<key>SubjectAltName</key>

<dict>

<key>dNSName</key>

<string>scepsrv.myorg.com</string>

</dict>

<key>GetCACaps</key>

<dict>

<array>

</array>

</dict>

SubjectAltName has no problem.

GetCACaps doesn't seem to work - my iphone 5 thought the profile is invalid.

But the doc seems to imply (without examples) that it is possible.

http://developer.apple.com/library/ios/#featuredarticles/iPhoneConfigurationProf ileRef/Introduction/Introduction.html

I am using Windows 2008 sp2 NDES. No patch for GetCACaps. Hence I have to work around by specifying the CACapability.

Much appreciated!

Jan 2, 2013 2:23 PM in response to Simon So

Any chance of using Windows 2008 R2?

Only as there is a GetCACaps hotfix for it - http://support.microsoft.com/kb/2483564

Simon So

Level 1

0 points

Jan 2, 2013 2:36 PM in response to prichardson

Thanks Mr. Richardson! Unfortunately we only had windows 2008 sp2 installation + SCEP.

Getting everything set up on a totally different platform is a huge endeavor.

Maybe I have to resort to Windows 2008 R2 after all.

Simon So

Level 1

0 points

Jan 3, 2013 9:18 PM in response to Simon So

Finally solved my own problem.

I am using Windows 2008 sp2 NDES, which does not have GetCACaps hot fix like Windows 2008 R2.

What I did: proxy all SCEP operations.

In case of GetCACaps, just hardcode the reply DES3 and SHA-1, such that iPhone does not choke on Windows NDES's blank response.

Everything else (GetCACert and PKIOperation), just proxy the call to Windows 2008 unchanged and set the appropriate Content-Type per spec.

It was quite a journey, but well worth it.

Also, all the advice on the web about the NDES setup is crucial, especially when you change the settings in and bounce one instance (e.g. Domain Controller), you have to bounce the other NDES server too. I come to know when things didn't work. Then I debugged the Event Logs in NDES.

My advice to others: jscep helps one to understand what's going on behind the scene, but it may not be practical for actual production-grade deployment. Need to take SCEP admin maintenance into consideration.

Sep 30, 2016 12:14 AM in response to froowstie

Finally after trying out for months i got it working .Its working fine with Certificate based authentication for Exchange server.We are trying it for Wi-Fi

iPhone & certificate enrollment OTA via SCEP