OTA Mobileconfig encryption - profile could not be decrypted - Decryption key for this profile is not installed.

Question

Hi -I&#x27;m trying OTA enrollment. I&#x27;m using MS-AD for SCEP 1. In step 1 device responds with device details signed by the private key from certificate from apple.2. In step 2 my profile service sends a message to get a certificate from SCEP (AD) server3. In step 3 device responds with device details signed by private key from certificate from SCEP server.4. In step 4 my profile service encrypts the profile with public key from certificate from SCEP server.I&#x27;m getting message that the profile can&#x27;t be decrypted. Exact error message is"OTA Mobileconfig encryption - profile could not be decrypted - Decryption key for this profile is not installed."Can somebody confirm if format of my encrypted profile is correct.Here is the encrypted profile. The encrypted payload is between &lt;data&gt; tag. The unencrypted version of payload is also listed below.1. Encrypted profile&lt;?xml version&#x3D;"1.0" encoding&#x3D;"UTF-8"?&gt;&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;&lt;plist version&#x3D;"1.0"&gt;&lt;dict&gt;        &lt;key&gt;EncryptedPayloadContent&lt;/key&gt;        &lt;data&gt;......Redacted - the encrypted data .....              &lt;/data&gt;                &lt;key&gt;PayloadDescription&lt;/key&gt;    &lt;string&gt;Profile description.&lt;/string&gt;        &lt;key&gt;PayloadDisplayName&lt;/key&gt;        &lt;string&gt;MyCompany Test Profile&lt;/string&gt;        &lt;key&gt;PayloadIdentifier&lt;/key&gt;        &lt;string&gt;com.mycompany.profile&lt;/string&gt;        &lt;key&gt;PayloadOrganization&lt;/key&gt;        &lt;string&gt;&lt;/string&gt;        &lt;key&gt;PayloadRemovalDisallowed&lt;/key&gt;        &lt;false/&gt;        &lt;key&gt;PayloadType&lt;/key&gt;        &lt;string&gt;Configuration&lt;/string&gt;        &lt;key&gt;PayloadUUID&lt;/key&gt;        &lt;string&gt;C4BBB40B-1BFB-4CFC-83E1-A1D5270D05D3&lt;/string&gt;        &lt;key&gt;PayloadVersion&lt;/key&gt;        &lt;integer&gt;1&lt;/integer&gt;&lt;/dict&gt;&lt;/plist&gt;2. payload in plain text. I&#x27;m inserting this payload between &lt;data&gt; tag after encryption&lt;array&gt;                &lt;dict&gt;                        &lt;key&gt;PayloadDescription&lt;/key&gt;                        &lt;string&gt;Configures device restrictions.&lt;/string&gt;                        &lt;key&gt;PayloadDisplayName&lt;/key&gt;                        &lt;string&gt;Restrictions&lt;/string&gt;                        &lt;key&gt;PayloadIdentifier&lt;/key&gt;                        &lt;string&gt;com.houston.profile.restrictions&lt;/string&gt;                        &lt;key&gt;PayloadOrganization&lt;/key&gt;                        &lt;string&gt;&lt;/string&gt;                        &lt;key&gt;PayloadType&lt;/key&gt;                        &lt;string&gt;com.apple.applicationaccess&lt;/string&gt;                        &lt;key&gt;PayloadUUID&lt;/key&gt;                        &lt;string&gt;61FD34AC-F388-44B5-BCD7-C602CB382469&lt;/string&gt;                        &lt;key&gt;PayloadVersion&lt;/key&gt;                        &lt;integer&gt;1&lt;/integer&gt;                        &lt;key&gt;allowAddingGameCenterFriends&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowAppInstallation&lt;/key&gt;                        &lt;false/&gt;            &lt;key&gt;allowAssistant&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowCamera&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowCloudBackup&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowCloudDocumentSync&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowDiagnosticSubmission&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowExplicitContent&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowGlobalBackgroundFetchWhenRoaming&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowInAppPurchases&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowMultiplayerGaming&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowPhotoStream&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowSafari&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowScreenShot&lt;/key&gt;                        &lt;false/&gt;            &lt;key&gt;allowUntrustedTLSPrompt&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowVideoConferencing&lt;/key&gt;                        &lt;true/&gt;                        &lt;key&gt;allowVoiceDialing&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowYouTube&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;allowiTunes&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;forceEncryptedBackup&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;forceITunesStorePasswordEntry&lt;/key&gt;                        &lt;false/&gt;                        &lt;key&gt;ratingApps&lt;/key&gt;                        &lt;integer&gt;1000&lt;/integer&gt;                        &lt;key&gt;ratingMovies&lt;/key&gt;                        &lt;integer&gt;1000&lt;/integer&gt;                        &lt;key&gt;ratingRegion&lt;/key&gt;                        &lt;string&gt;us&lt;/string&gt;                        &lt;key&gt;ratingTVShows&lt;/key&gt;                        &lt;integer&gt;1000&lt;/integer&gt;                &lt;/dict&gt; &lt;/array&gt;

sfromaa · Answer

hi venkygcthave you been able to resolve this issue? I am also getting this same error. I would really appreciate it if you can please add the solution here if you have resolved this issue. Thanks much

ken fromlewis center · Answer

I have the same issue.  Did you have any luck resolving this?

zahidmaqbool · Answer

How are you encrypting the payload? It is meant to be done using PKCS7 Envelope. Are you doing the same?

sfromaa · Answer

Yes I am using -encrypted_profile &#x3D; OpenSSL::PKCS7.encrypt(@@p7sign.certificates, payload, OpenSSL::Cipher::Cipher::new("des-ede3-cbc"), OpenSSL::PKCS7::BINARY)where @@p7sign.certificates are the certificates used by phone to sign its response and sent to the server  and payload is the PLIST that i want to encrypt.Any help would be really appreciated.Thanks

sfromaa · Answer

Hi @ken fromlewis centerNo I have not yet been able to resolve this issue. How about you ?

Stibra101 · Answer

I am not a developer, but you can not use public key from SCEP server to encrypt profile for the phone.You have to use public key from SCEP certificate issued to the phone, that means that iPhone have to send it&#x27;s public key after SCEP enrollment. YOu have to catch the public key in the iPhone response and use that public key to encrypt the profile.Please let us know when you make this happen!

keithgabryelski · Answer

have you resolved this issue?  I am having a similar problem, following the example code provided by apple (https://developer.apple.com/library/ios/#documentation/NetworkingInternet/Concep tual/iPhoneOTAConfiguration/profile-service/profile-service.html#//apple_ref/doc /uid/TP40009505-CH2-SW2)any ideas?

i1Eugen · Answer

I have a C++ version of Profile Service. The same problem:Jul  8 16:38:51 iPhone-*** profiled[1454] &lt;Notice&gt;: (Note ) MC: Attempting to retrieve issued certificate...Jul  8 16:38:51 iPhone-*** profiled[1454] &lt;Notice&gt;: (Note ) MC: Issued certificate received.Jul  8 16:38:52 iPhone-*** profiled[1454] &lt;Notice&gt;: (Note ) MC: Retrieving profile from OTA Profile service...Jul  8 16:38:52 iPhone-*** profiled[1454] &lt;Notice&gt;: (Error) MC: Decryption failed: NSError:Desc   : Profile could not be decryptedSugg   : Decryption key for this profile is not installed.US Desc: Profile could not be decryptedUS Sugg: Decryption key for this profile is not installed.Domain : MCProfileErrorDomainCode   : 1006Type   : MCFatalErrorI have compared my all certificates which are generated from C++ (X509, PKCS7, etc). They are similar to the Apple Ruby example. I cannot imagine what I should check next.Has anyone solved the issue?