Gregory DiFiore

Q: Profile Manager Error 500 on client enrollment

My Profile Manger has been working great for a year now.  I did an update the other day and now I am getting an error and can not enroll devices.  The client says error 500 with at_service.php.  Below are the server logs.  Any suggestions on how to get the enrollment working agian?

 

0::Aug 17 20:24:25.432 [246] <10.0.1.12> Completed in 422ms | 200 OK [https://<SERVER-FQDN>/devicemanagement/mdm/ota_bootstrap.php]

0::Aug 17 20:24:34.500 [247] <10.0.1.12> EXCEPTION: Could not retrieve SCEP challenge. at

0::Aug 17 20:24:34.500 [247] <10.0.1.12> #0 /Applications/Server.app/Contents/ServerRoot/usr/share/devicemgr/backend/php/ot a_service_common.php(361): _generate_scep_profile(Array)

0::Aug 17 20:24:34.500 [247] <10.0.1.12> #1 /Applications/Server.app/Contents/ServerRoot/usr/share/devicemgr/backend/php/ot a_service.php(14): OTAServiceCommon(false)

0::Aug 17 20:24:34.500 [247] <10.0.1.12> #2 {main}

0::Aug 17 20:24:34.500 [247] <10.0.1.12> Completed in 142ms | 500 Internal Server Error [https://<SERVER-FQDN>/devicemanagement/mdm/ota_service.php]

iPhone 4, iOS 5.0.1

Posted on Aug 17, 2013 7:37 PM

Close

Q: Profile Manager Error 500 on client enrollment

  • All replies
  • Helpful answers

Page 1 Next
  • by Dirk777,

    Dirk777 Dirk777 Aug 25, 2013 9:37 AM in response to Gregory DiFiore
    Level 1 (0 points)
    Aug 25, 2013 9:37 AM in response to Gregory DiFiore

    I have got the same problem

  • by Marc Kerr,

    Marc Kerr Marc Kerr Aug 27, 2013 11:10 AM in response to Gregory DiFiore
    Level 1 (0 points)
    Aug 27, 2013 11:10 AM in response to Gregory DiFiore

    I had a similar issue. Unfortunately I had to almost completely rebuild . I tried this option http://pintofcode.com/blog/2013/2/28/restoring-profile-manager which did not work either. I even restored from a Time Machine backup without success. However after trying the restore I moved the Server.app out of Applications then back in. In this case it destroyed my OD but I was able to get the profile server up and running without doing a full rebuild.

     

    I want to properly test this but I wondered if I could backup my OD, move the server app then restore the OD and have things work. I'm not real hopeful about that.

     

    A couple of other things you might look at.

    Check the Access Control settings for all of your servers private keys in Keychain Access. I didn't look at this info when I had my issue and it's possible something wasn't right there. It appears that all of mine allow access by any app.

     

    I believe I saw that someone else had the issue and just ran a Server update and things were fixed. I tried running the Combo update for 10.8.4 but that didn't help. I suspect a 10.8.5 update and server update will be coming out soon. You might wait for that to see if those updates help. Run the Combo updater when it comes out then the server update.

     

    I'm very interested if you find a real solution.

  • by Gregory DiFiore,

    Gregory DiFiore Gregory DiFiore Aug 27, 2013 6:40 PM in response to Marc Kerr
    Level 1 (10 points)
    Aug 27, 2013 6:40 PM in response to Marc Kerr

    Thanks for the suggestions but still no luck.  It appears that an update might have actually broke it.  I verified all my public keys and only two of them were not set for any app.  I changed these two and then restarted Profile Manager, but no luck.

  • by Dirk777,

    Dirk777 Dirk777 Sep 2, 2013 10:37 PM in response to Gregory DiFiore
    Level 1 (0 points)
    Sep 2, 2013 10:37 PM in response to Gregory DiFiore

    I fixed it!!!! After days of investigating I figured out that my System.keychain was not valid anymore. So I created a new one with

     

    sudo systemkeychain -vfcC "password"

     

    I recommend to use the C-Option with a password. So you have access after getting it from time machine. Afterwards go with configuring profilemanager. All your certificates will be created automatically. But in my case the following certificates didn't appear:

     

    com.apple.kerberos.kdc

    com.apple.systemdefault

    Device Management Identity Certificate

     

    I assume this was the problem (missconfigured Kerberos) was causes the error above. I fixed this issue with

     

    sudo /usr/libexec/configureLocalKDC

     

    I configured the profile manager again and finally it works.

     

     

     

    If you want to build it up from scratch you can do as follows (with sudo), Make sure that all your private certificate, your OD and other important datas are backuped well.

     

     

     

    rm -R /var/root/Library/Application\ Support/Certificate\ Authority

    rm /etc/certificates/*

    rm /Library/Server/Web/Config/apache2/sites/0000_any_443_.conf

    rm /Library/Keychains/System.keychain

    slapconfig -destroyldapserver

    /Applications/Server.app/Contents/ServerRoot/usr/share/devicemgr/backend/wipeDB. sh

    /Applications/Server.app/Contents/ServerRoot/usr/sbin/serveradmin stop devicemgr

    systemkeychain -vfcC "password"

    sudo /usr/libexec/configureLocalKDC

     

    Configure profile manager within Server App

     


    Maybe you need to repair dovecot manually by editing /Library/Server/Mail/Config/dovecot/conf.d/10-ssl.conf and pointing the certificate parameters to the the apropriate ones stored at /etc/certificates

     

    Maybe this works for you as for my did. I do not guarantee for any loss of data!!

  • by Gregory DiFiore,

    Gregory DiFiore Gregory DiFiore Sep 4, 2013 10:24 AM in response to Dirk777
    Level 1 (10 points)
    Sep 4, 2013 10:24 AM in response to Dirk777

    If I do the steps you outlined, will any of my users be gone from Open Directory or Profile Manager?  What about their devices?

     

    I have a lot of both that i would like to keep in the Profile Manager as well as two or three devices per user. 

  • by Dirk777,

    Dirk777 Dirk777 Sep 4, 2013 10:11 PM in response to Gregory DiFiore
    Level 1 (0 points)
    Sep 4, 2013 10:11 PM in response to Gregory DiFiore

    If you are going from scratch, you will loose OD Users and Devices in profile manager.

     

    But before setting back od and pm I would check, if your certificates are there and valid and if kerberos is fine

  • by °Bernz°,

    °Bernz° °Bernz° Mar 27, 2014 5:34 AM in response to Gregory DiFiore
    Level 1 (14 points)
    Servers Enterprise
    Mar 27, 2014 5:34 AM in response to Gregory DiFiore

    Hi,

     

    I actually got this error (EXCEPTION: 500 Internal Server Error - Could not retrieve root certificate from open directory server.) and I wasted a lot of time on this.

     

    In my case, I upgraded OS X Server 3.0.3 to 3.1, which scrapped my Profile Manager DB after deleting a person from Wiki... But that's another story.

     

    Anyways, I came back to 3.0.3 through Time Machine (thank you TM!) by copying /Applications/Server.app (3.0.3) and the entire /Library/Server folder.

     

    But this is where I got error 500 while trying to enroll a device. Turns out that Profile Manager depends on many things (APN, DNS, plists, etc.) and one of these things are Open Directory. Turns out that it was "simply" turned off in the OS X Server interface. I simply turned it back on, and error 500 was gone...

     

    So, basically, Profile Manager needs Open Directory, even if you're not using it.

     

    Might not be the source of your problem, but it was mine. And after a few days wasted, I'm happy to see that it was this simply.

     

    (It would have been nice for OS X Server to say: "Hey, by the way, OD is turned off... This could cause an issue. You might want to turn it back on"...)

  • by Marco V,

    Marco V Marco V Apr 10, 2014 1:37 AM in response to Gregory DiFiore
    Level 1 (0 points)
    Apr 10, 2014 1:37 AM in response to Gregory DiFiore

    I was having the same issue.

     

    Lucky me, all I needed to do to fix the problem was to turn Open Directory off and back on again.

  • by ThePulsingEye,

    ThePulsingEye ThePulsingEye Apr 15, 2014 8:44 PM in response to Gregory DiFiore
    Level 1 (0 points)
    Apr 15, 2014 8:44 PM in response to Gregory DiFiore

    I was having the exact same problem for over a year, and basically gave up completely on Profile Manger, but after revisiting it for the 4th or 5th time today discovered a solution that may work for you. 

     

    Basically http://pintofcode.com/blog/2013/2/28/restoring-profile-manager wasn't too far off, it's just missing a few crucial steps, clearing out the CA's from your LDAP records, and purging "/var/root/Library/Application Support/Certificate Authorities/" folder.  You will loose your CA's and have to reinstall all of your trust profiles if you don't have a Certificate signed by an Trusted CA, but you don't need to completely destroy your OpenDirectory and loose all of you user's passwords.

     

    I've got a write up on my github page that may help.    https://github.com/eahrold/OSX_Server_Notes/blob/master/Fixing_Profile_Manger.md

  • by essandess,

    essandess essandess Apr 20, 2014 4:54 AM in response to ThePulsingEye
    Level 1 (28 points)
    Applications
    Apr 20, 2014 4:54 AM in response to ThePulsingEye

    These lengthy steps involving destroying the Open Diectory Master, wiping the Profile Manager database, destroying the LDAP Server, then rebuilding from the ground up, fixed this problem for me: https://discussions.apple.com/message/25526659#25526659

  • by jeff_grunewald,

    jeff_grunewald jeff_grunewald Jun 12, 2014 11:00 AM in response to Gregory DiFiore
    Level 1 (0 points)
    Jun 12, 2014 11:00 AM in response to Gregory DiFiore

    Have you made sure the server is still selected to sign configuration profile (including the Trust Profile) in Profile Manager? I found that in switching to Server 3+ it unset this drop-down from the Profile Manager tab and turning it back on was just a matter of verifying the existing certificate you were using in the Server App - Certificates page, then navigating to the Profile Manager page and re-checking the box next to "Sign Configuration Profiles".

     

    I have actually seen this happen on a couple of different servers, so I think it is a problem inherent in the update to Server 3.

  • by fracsupport,

    fracsupport fracsupport Sep 16, 2014 3:44 AM in response to Gregory DiFiore
    Level 1 (0 points)
    Sep 16, 2014 3:44 AM in response to Gregory DiFiore

    A reboot fixed this for me, please try this before going through any lengthy OD/PM rebuild routines!!

  • by alexander132,

    alexander132 alexander132 Dec 29, 2014 6:14 AM in response to fracsupport
    Level 1 (4 points)
    Servers Enterprise
    Dec 29, 2014 6:14 AM in response to fracsupport

    reboot fixed for me as well! Thanks, man!

  • by MedPharm,

    MedPharm MedPharm Dec 29, 2014 9:13 PM in response to Dirk777
    Level 1 (0 points)
    Dec 29, 2014 9:13 PM in response to Dirk777

    I need some help.

     

    I tried sudo systemkeychain -vfcC "password" command and lost all my certificate under server app.

    I did time machine backup and restore keychain system file and got certificate back but now profile manager is not starting.

     

    Safari cannot connect to the server.

     

    Locally or remotely.

     

    I am not Mac pro and need some help getting it back up and running.

     

    Log says

     

    unable to find the passphrase for exported private key.

     

    Since i changed password for systemkeychain its the issue.

Page 1 Next