Unable to deploy Mobile Config for Active Sync on iOS 13.4.1

Question

Level 1

6 points

Unable to deploy Mobile Config for Active Sync on iOS 13.4.1

I'm trying to deploy a mobile configuration for a number of iPhones. The mobile configuration only includes PKCS12 for the client certificate authentication and the configuration of the MS Exchange Active Sync Server.

I have an older ".mobileconfig", we've previously used and I have one with the same data, but generated by the current "Apple Configurator 2" from the App Store.

The old.mobileconfig crashes without any further info, on the last step, after the user password for the Active Sync has been entered on iOS 13.4.1 but works perfectly fine on iOS 13.2.2 (both iPhone SE).

With the new.mobileconfig, the setup finishes just fine and the profile is set up on the client, but it fails to connect to the sync server with the client certificate, both on iOS 13.4.1 and iOS 13.2.2.

Upload for "Additional Text" keeps failing for me on here, so I'll attach a redacted version of both configuration files like so:

old.mobileconfig: https://pastebin.com/X8Q0U90M

new.mobileconfig: https://pastebin.com/bLs2wBcS

My patience grows thin with this setup, so I am asking for help here.

What is the issue with my mobileconfigs, how can I correctly generate/adjust the mobileconfig to have our iPhones connect to our Active Sync server with client certificate authentication?

iPhone SE

Posted on Apr 14, 2020 2:33 AM

Reply

Answer 1

garliccheese Author

Level 1

6 points

May 7, 2020 5:42 AM in response to celliott147

First off, thank you for the note about the Profile Creator - this seems like a much more elaborate and convenient solution than the official Apple Configurator 2.

This issue has been resolved. As I posted here (https://discussions.apple.com/thread/251296709 ), I did identify a bug with the current iOS and iPadOS versions, where client certificate authentication was not working anymore.

After reaching out to Apple via official bug reports, twitter and on here. (Plus posting on reddit and stackexchange), with no no feedback, this finally seems to be fixed in the iOS BETA 13.5 (17F5065a).

Reply

Answer 2

celliott147

Level 6

12,582 points

Apr 21, 2020 8:03 AM in response to garliccheese

When I looked at the configs, it appears that this is missing from the new profile. With a certificate issue, could this be the cause?

 <key>PayloadCertificateUUID</key>
            <string>UUID1</string>

Reply

Answer 3

garliccheese Author

Level 1

6 points

Apr 20, 2020 10:14 PM in response to garliccheese

The issue appears to be a bug of the latest iOS version, where the client certificate is not for authentication. I was able to replicate the issue with other services and proof that it works with older iOS versions. I've already written a bug report but I have yet to hear back from apple.

Reply

Answer 4

celliott147

Level 6

12,582 points

Apr 22, 2020 7:23 AM in response to garliccheese

That really appeared to be the only difference. Could you try building the same profile in something like Profile Creator? (It's an open source Git project that is a little more robust in my opinion).

Reply

Answer 5

garliccheese Author

Level 1

6 points

Apr 21, 2020 9:48 PM in response to celliott147

Thanks a lot for the input! I believe that should be no issue. The new profile was created with the latest Apple Configurator, so there would have to be an issue there. I've also found no clear description of what all these UUIDs do and even found most of them completely irrelevant during my tests.

But I'll edit the new profile, add the UUID and repeat the test, just to make sure!

I think I've narrowed down this problem to a bug of the latest iOS version with client certificate authentication. I've described it here on the AskDifferent StackExchange: https://apple.stackexchange.com/questions/389020/client-certificate-authentication-fails-with-ios-13-4-1-works-with-13-2-2

Reply

Answer 6

garliccheese Author

Level 1

6 points

Apr 14, 2020 10:34 PM in response to celliott147

Correct. The Exchange is installed on premise, but we access it online via a reverse proxy and use client certificates for the authentication on the reverse proxy. The setup works fine with the old.mobileconfig and the slightly older iOS version (13.2.2).

Edit: I've also tried a complete reset of the updated iPhone (iOS 13.4.1), but the issue remains.

Reply

Answer 7

celliott147

Level 6

12,582 points

Apr 14, 2020 12:29 PM in response to garliccheese

You're using on-Prem Exchange, correct?

Reply

Answer 8

garliccheese Author

Level 1

6 points

Apr 21, 2020 11:27 PM in response to celliott147

I've just tried to add the PayloadCertificateUUID with the appropriate key in the new profile, but unfortunately that didn't change anything for me. But that was quite a reasonable approach!

Reply

Answer 9

celliott147

Level 6

12,582 points

May 7, 2020 10:05 AM in response to garliccheese

My pleasure. Thank you for not giving up and making sure it was reported! And I'm happy to hear of a fix!

Reply

Unable to deploy Mobile Config for Active Sync on iOS 13.4.1

Similar questions