How do I renew an expired certificate for Apple Configurator?

I have this issue as well. In Keychain Access, there is an "Apple Configurator (88:1F:A1:xx:xx:xx)" certificate that expired a few days ago. Since then I have been unable to update policies on the iPads controlled by it. If I select the policy and make a change, the changes don't apply to the iPads properly. Presumably because the certificate has expired. The iPads also show the cert is expired under Settings>General>Profiles.

I also am having the same issue when trying to use the configurator to image new iPads...this is preventing me from even installing mdm profiles...I have even tried under keychain settings to trust the certificate; however, that doesn't seem to matter. I am running configurator 1.6 on Mavericks and installing on iPads IOS8.

Make some screen shots from the expired certificate, export it (backup) and delete it with the Keychain Access App.

1) Apple Configurator will create a new certificate at the next app start. Validity again for one year.

or

2) You can use the Certificate Assistant to generate a new root certificate for code signing. The name is something like "Apple Configurator (Ethernet-ID)". If you have an other trusted CA (best from Open Directory or Active Directory), you can generate a IntermediateCA for Code signing and sign it with the trusted CA. Btw you can also enhance the validity to 10 or more years.

Hope this helps

For me, the expired certificate problem appears to be connected iOS 8 update from iOS 7. Our certificate was renewed in April 2014 and was valid until April 2015. The renewed credentials have disappeared and our iPads now show that our certificate expired in April 2014. Restoring from a backup with the valid certificate fails to update to the correct certificate.

Really need a response to this issue.

since updating my 400 iPads to iOS 8.02 via apple configurator the apple Configurator certificate shows as expired and i cannot make changes to the restrictions on the iPad.

Apple please tell us how to renew this certificate.

The fix posted by SSI JDE worked for me:

"Make some screen shots from the expired certificate, export it (backup) and delete it with the Keychain Access App.

1) Apple Configurator will create a new certificate at the next app start. Validity again for one year."

The Keychain certificates are named:

Apple Configurator - public key

Apple Configurator - private key

Steps:

Quit Configurator if running.

From Keychain Access export both certificates to the Desktop.

Delete the 2 certificates from Keychain Access.

Restart Configurator - this should generate 2 new, valid certificates.

If this works then the backup of the old certificates can be deleted.

Thanks for the response but thats not really an option for me, as generating a new certificate means that previously supervised devices are wiped and resupervised, these are school owned iPads and I'm not going to sit there and put in 400 apple id's again. I need to be able to renew my existing certificate and i would like apple to tell me how to achieve that.

I am in the same situation as "surfee" - any ideas on how to rectify this issue?

Cheers,

Phil

I purposely waited until my certificate expired, to see what happens. I could still set up iPhones, the expiration date did not matter. Your problems must have a different cause. There are always problems when "Find my iPhone" is enabled, Restrictions are set or the device is already managed by profiles. Also don't execute iTunes and Apple Configurator at the same time. Quit iTunes before starting Apple Configurator.

Just try the following with a iPad for testing:

disable all Restrictions (Setting: General: Restrictions)

remove iCloud (Settings: iCloud)

remove iTunes & App Store (Settings: iTunes & App Store)

remove all Profiles (Settings: General: Profiles & Device Management)

reset all Settings (Settings: General: Reset)

Connect the iPad via USB. On iOS 8, you have to confirm that you trust the computer. After that, the iPad should be configurable with the Apple Configurator again, even with an expired certificate.

Best regards,

SSI JDE

Hi Thanks for the reply

yes i agree devices that were previously supervised it has no adverse effect on really, other than sometimes i have to remove and reinstall the profile to get setting changes to apply, and on the actual device it says the certificate is expired but you see no adverse effects and the certificate cannot be removed so the device it still safe.

when you have new devices not previously supervised ( we have just got another 30 for new pupils to school ) you can supervise them etc and remove and re add profiles but some settings do not apply at all, and on the actual device the certificate os shown in red and you can just click remove and boom the device has no restrictions on it as doing this pulls off the configuration profiles as well. Obviously this is a massive problem as the kids will just remove and do what they like on the iPads.

if i delete the certificate from my keychain and let Configurator make a new one then my previously supervised devices will have to all be set up again, and if i leave it as it is, then my new devices are insecure.

the kids at our school are all allocated an iPad, they can take home they are aged 4 to 11, we have lots of new children starting all through the year currently i have 30 waiting to get there iPads and i can't proceed due to this issue.

there surely has to be a way to renew this certificate, i can't be the first person to encounter this issue, if they expire after a year then others much of had this issue.

any help/advice greatly appreciated.

many many thanks

1. The update of profiles will not work properly, installed profiles must be manually deleted before updating.

2. Also you need an internet connection the first time you connect a iOS Device

In the recent month i shared some mobile Configuration files with public internet calenders to friends. Some Profiles i exported as text files and sent them via email. After changes i tried to install updated Profiles. No error message, all looks fine, but the old Profiles stayed there and nothing was updated.

The Payload Definitions contains fields for version numbering, but changes have no effect. You have to delete the previous installed Profiles before updating them. This applies to text files and installations with the Apple Configurator. This maybe the reason why you get still displayed the expired certificate.

You can not protect the Setup Profile. For all other you can change the General settings for "Security" and "Automatically Remove Profile" to protect them.

If this doesn't work for you, make an appointment at the next genius bar: Apple Retail Store - Genius Bar.

Btw. some of my profiles contain passwords for wireless access and email accounts. I did not want to send them via email. Connecting the first time a iOS Device I could not install any files with the apple configurator, without a Internet Connection for my computer and confirming a Trust-Message on the iOS Device.

Best Regards,

SSI JDE

Hi

on a previously supervised device, the configurator trust certificate is not removable, there is no option to remove it, even though the certificate is now expired.

on newly supervised devices (supervised after the certificate expired) there is a big red remove button once you hit that it pulls off all profiles regardless of if you have set only remove with password option.

hardly any point in supervising them at all now.

looking like i will have to either generate a new certificate or get a new mac for my new iPads

cheers

Hi surfee,

create a new user account on your mac. Starting Apple Configurator will create a new certificate for this new account. You can still use the older account with the expired certificate.

Kind Regards,

SSI JDE

Did anyone get a solution besides wiping the iPads?

This worked for us:

Close iTunes and Apple Configurator

Go into Keychain Access and change the trust of the expired cert(s) to 'Always Trust"

Close Keychain Access and restart Configurator. You should now be able to attach your previously supervised devices and supervise new ones without having to renew the certificate.