Server 5.11 Profile Manager Admin Site blank/empty

After upgrading Server 5.10 on Catalina to BigSur 11.1 and Server 5.11:

Profile Manager was running as usual, after 3 weeks suddenly the profile manager admin site is not accessible. When calling the server in any browser, the selection between MyDevices and ProfileManager is visible. MyDevices page is working. Profile Manager is asking for login, after filling credentials and sending login only blank page is shown. Sometimes after some time a message is shown „network error“, sometimes nothing happens. In browser console error regarding javascript-packed is shown.

In browsers the correct SSL certificate is shown.

In server logs I see all devices communicate with the MDM.

In Server app reachability for Profile Manager ok, PM running. Button MyDevices working. Button ProfileManager leading to blank page.

Did reinstall MacOS, deleted Server app and reinstalled it several times.

Any help or hint appreciated.

Posted on Jan 7, 2021 1:30 PM

Reply
Question marked as Top-ranking reply

Posted on Mar 11, 2021 10:07 AM

Sorry guys, been very busy. So here is the solution if you are affected after update/renewal of your SSL certificate.

Beware: no guarantee, on your own risk, and you should have backup of course.


1: Find your current used public certificate and its Fingerprint in Server App/Certificates:

In Server App go to Certificates. In „secure services“ dropdown your current public SSL cert should be selected.

In the list of certificates below, find this cert and double click to see the certificate info.

Scroll down all the way to Fingerprints and notice the SHA-1 Hash.


2: Switch back the „secure services“ dropdown to the self signed certificate. Close the server app.


3: Drag the Server.app to the trash bin. Confirm the warnings. Reboot the Mac.


4: Open Terminal and execute:  sudo rm /var/db/.ServerSetupDone 


5: in Finder select menu option „go to folder“: /private/etc/certificates


6: delete the 4 certificate files of your SSL certificate, they are named like:

your.hostname.SHA1-HASH. with endings cert.pem/ key.pem / concat.pem / chain.pem


7: delete the the Alias „default_certificate“ !


8: install Server.App, open it and wait until setup is finished


9: go to Certificates and re-install your public signed SSL certificate, afterwards select it under „secure services“


10: restart profile manager service



the admin page should now work again. good luck everyone.

Similar questions

28 replies
Question marked as Top-ranking reply

Mar 11, 2021 10:07 AM in response to Loopi

Sorry guys, been very busy. So here is the solution if you are affected after update/renewal of your SSL certificate.

Beware: no guarantee, on your own risk, and you should have backup of course.


1: Find your current used public certificate and its Fingerprint in Server App/Certificates:

In Server App go to Certificates. In „secure services“ dropdown your current public SSL cert should be selected.

In the list of certificates below, find this cert and double click to see the certificate info.

Scroll down all the way to Fingerprints and notice the SHA-1 Hash.


2: Switch back the „secure services“ dropdown to the self signed certificate. Close the server app.


3: Drag the Server.app to the trash bin. Confirm the warnings. Reboot the Mac.


4: Open Terminal and execute:  sudo rm /var/db/.ServerSetupDone 


5: in Finder select menu option „go to folder“: /private/etc/certificates


6: delete the 4 certificate files of your SSL certificate, they are named like:

your.hostname.SHA1-HASH. with endings cert.pem/ key.pem / concat.pem / chain.pem


7: delete the the Alias „default_certificate“ !


8: install Server.App, open it and wait until setup is finished


9: go to Certificates and re-install your public signed SSL certificate, afterwards select it under „secure services“


10: restart profile manager service



the admin page should now work again. good luck everyone.

Apr 8, 2021 4:44 AM in response to digiSimRo

After about one month without access to my PM admin page I've manage to get back access.

This is what I've done (try at your own risk):


Turn off PM (via ServerApp or Terminal sudo serveradmin stop devicemgr)


delete open tasks: sudo -u _devicemgr psql -U _devicemgr -d devicemgr_v2m0 -h /Library/Server/ProfileManager/Config/var/PostgreSQL-12 -c "DELETE FROM library_item_tasks WHERE completed_at IS NULL"


delete finished tasks (this took very very long since it was about 49000 tasks to delete): sudo -u _devicemgr psql -U _devicemgr -d devicemgr_v2m0 -h /Library/Server/ProfileManager/Config/var/PostgreSQL-12 -c "DELETE FROM library_item_tasks WHERE completed_at IS NOT NULL"


Turn on PM again (via ServerApp or Terminal sudo serveradmin start devicemgr)


Hope this might be helpful. If so, please let me know!


Feb 18, 2021 4:33 AM in response to zheisey33

Try this hope it helps...


"Copy and Open pg_hba.conf"

Library/Server/ProfileManager/postgreSQL/

In that folder you have the file pg_hba.conf

copy that file to desktop open it with

text editor (you must have write permission to that file)

and add the line in that file (below)(add this line)

Before do stop profilemanager service

copy back the file to Library/Server/ProfileManager/postgreSQL/

and restart the hole machine.

Hope that helps



This is the pg_hba.conf file


# PostgreSQL Client Authentication Configuration File

# ===================================================

#

# Refer to the "Client Authentication" section in the PostgreSQL

# documentation for a complete description of this file.

#

# TYPE DATABASE USER ADDRESS METHOD


local all root peer

local all _devicemgr peer

local devicemgr_v2m0 devicemgrd trust

local devicemgr_v2m0 webadmin trust

local devicemgr_v2m0 deviceservice trust

local devicemgr_v2m0 dmscepservice trust

local devicemgr_v2m0 authservice trust (add this line)

# Allow replication connections from localhost, by a user with the replication privilege.

local replication _devicemgr trust


local all all reject

Feb 28, 2021 4:26 AM in response to cragiboy

I've got two solutions or workarounds which might help (from a good colleague):


1: To get it to run again, he runs the following in terminal:


sudo serveradmin stop devicemgr

/Applications/Server.app/Contents/ServerRoot/usr/share/devicemgr/config/refreshDB

sudo serveradmin start devicemgr


Then he deletes all active tasks.


2.: to keep it running:


After executing the code above he has left a safari window/tab with profile manager open on the server. So far, the problem has not occured again. Might be it does not occur as long as a PM-tab remains open constantly.


I'm really looking forward to hearing if that works for you as well.

Feb 18, 2021 4:24 PM in response to Loopi

Hey guys, just a quick follow up: i solved the problem on our server. It was caused by old cached SSL certificate. 

In November I replaced the SSL certificate on the server, and some weeks later the problem appeared.

Let me know if you are interested in the solution, and I will post it here, but please consider that this only makes sense if you are affected by the issues after you replaced or renewed your SSL certificate.

Regards

Mar 13, 2021 9:23 AM in response to zheisey33

thank you for sharing this. But as stated above, in my case the blank admin page was caused by profile manager somehow using the old expired ssl certificate. The default_certificate alias always pointed to the wrong certificate even after multiple reinstalls of the server app and current valid ssl certificate. Maybe there are different issues leading to the same problem?

Feb 24, 2021 8:35 AM in response to cragiboy

No, since the problem occurs on a productive system (managing about 240 devices) I don't want to risk anything. So no beta on my system.

At present, my PM Admin site is visible again. Hope it stays that way.


I was told by a collegue with the same problem that his postgres-process is running at 100% (or close to it) whenever the problem occurs. Can you verify that? (I can't at the moment, since the problem seems to be temporarily gone here).

Feb 24, 2021 10:58 PM in response to hikaru33

Unfortunately, I haven't got a solution at hand. I was only told that it will be fixed in the next server app update.


tbh I have no idea what caused it to work again. I did a restart, tried different browsers (on the mac itself and on other devices), tried private browsing, deleted browser cache. But I've tried all of this before and all of this did not work.


I then called Apple support, and while I was on the phone it started to work again (sometimes very slowly, though). But neither they nor I did anything. They did not even have accesss to my mac. So I guess it might as well be just sheer luck.


[Edited by Moderator]

Mar 12, 2021 10:35 AM in response to Loopi

Apple fixed the issue for me by doing this.


1.) Make sure you have a backup.

2.) Open terminal session and type this

sudo -Hu _devicemgr psql -U _devicemgr -d devicemgr_v2m0 -h /Library/Server/ProfileManager/Config/var/PostgreSQL-12

Press enter

3.) Then type this

CREATE OR REPLACE FUNCTION dm_cleanup_completed_tasks(max_tasks integer = 200) RETURNS void LANGUAGE plpgsql VOLATILE SECURITY DEFINER AS $$

<<__fn__>>

BEGIN

DELETE

FROM library_item_tasks

WHERE id IN (SELECT t.id

FROM library_item_tasks AS t

WHERE t.completed_at IS NOT NULL

ORDER BY t.updated_at DESC

OFFSET max_tasks

LIMIT 200);

END __fn__;

$$;


Type control d to end.

4.) Try accessing profile manager. It took a couple minutes for me but it eventually came up. It then took forever to load everything back in when clicking on things but it did.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Server 5.11 Profile Manager Admin Site blank/empty

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.