iOS Profile Manager Enrollment: Unverified Profile

Question

Level 1

41 points

iOS Profile Manager Enrollment: Unverified Profile

How do you fix an "Unverified Profile" error when enrolling an iOS device with https://(FQDN)/mydevices?

This was working previously, but—ughh—I mistakenly removed my Remote Management cert while experimenting with Profile Manager configurations. Now whenever I attempt to re-enroll my device, I get a green Verified Trust Profile, and a green Verified Device Enrollment cert, but when I hit Install, it flashes red Unverified at the last step and fails with the error:

Unverified Profile

The authenticity of "Remote Management" cannot be verified.

I've gone back and verified that I'm browsing to the exact same FQDN as specified in my server's cert, all on the LAN, that I have ports 1640,2195,2196,5218,5223 all open. This looks like some fragile Lion cert issue, but I have no idea how to troubleshoot or fix it. Any help would be greatly appreciated.

Mac mini Server (Mid 2010), Mac OS X (10.7.4), Lion Server, EyeTV HD, Turbo.264 HD

Posted on Jul 4, 2012 4:41 AM

Reply

Answer 1

Best reply

essandess Author

Level 1

41 points

Jul 4, 2012 7:16 PM in response to essandess

I got this working—here are the steps I took. Perhaps this can be simplified, but this worked for me:

1. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to iOS device and install. It should appear as a trusted profile within Settings.

2. Install Trust Profile via https://(FQDN)/mydevices. It should end up as green Verified cert in Profiles.

3. Enroll Device. This installs a Remote Management cert that is ultimately Unverified and red.

4. Delete the Trust Profile cert from Settings>General>Profiles

5. Again, install Trust Profile via https://(FQDN)/mydevices. It should end up as green Verified cert in Profiles. But now the Remote Management cert is Lso green and verified. Browse to https://(FQDN)/mydevices and see that device is enrolled.

6. Add specific profiles via https://(FQDN)/profilemanager.

Reply