Profiles not being signed

I'm in the same boat. If you download the profile directly from the server is it signed? For me the only time the profile is not signed is if it is pushed via APN. If I download the profile direct and install, the certificate is there and it says Verified. Via APN it says unsigned.

Some background:

This is a Mac Mini running 10.10.2 with server 4.0.3. Web services are running under a certificate issued by my company's CA and not the OD CA that profile manager creates during initial setup. Again, doesn't seem to be an issue since enrollment works and downloaded profiles seem okay. It is only when I push the profile via APN that it strips or cannot find the signing cert.

If you take the 'easy' route then Apple's Server.app will auto-generate all the certificates for you including a code-signing certificate. There are however two other ways, one is to buy an official server certificate and and official code-signing certificate - these are not the same thing. The other way is to generate your own self-signed server certificate using your own self-signed rootCA and one can also generate ones own self-signed code-signing certificate using the same self-signed rootCA.

The 'Trust' profile tells your devices to trust your self-signed rootCA, when you buy an official server certificate and/or official code-signing certificate these are signed by a 'well known' rootCA which is usually already installed and trusted on all computers.

I am using my own self-signed rootCA, and my own server certificates signed by my own self-signed rootCA. I am also using my own code-signing certificate again signed by my own self-signed rootCA. I can tell you from this experience that while generating a server certificate this way via openssl or possibly Keychain Access is relatively straight forward, generating a code-signing certificate this way verges on the impossible. I use XCA a free tool that acts as front-end for openssl to generate my self-signed rootCA, my server certificates, my code-signing certificate and if needed client certificates.

You do need to define different attributes for a code-signing certificate.

The end result is that all my certificates work and Profile Manager does show everything as both correctly Verified i.e. 'green' and correctly signed. While I pre-install the trust and enrolment profiles (and certificates) via my computer imaging process the settings profiles are then pushed over the air from Profile Manager, as stated this is working fine for me.

An added bonus is that I have been able to set longer expiration dates on my certificates. Apple's auto-generated ones if you use them only last a year.

Finally, push certificates are another totally different kind of certificate. These can only be generated via Apple's APNS web portal. This is because they have to be used with Apple's push notification servers. They are not the same thing as a code-signing certificate or a server certificate. You do not buy them they are free from Apple via the APNS portal. See https://identity.apple.com/pushcert/

If you are using Profile Manager then it includes a built-in wizard which automates generating an APNS certificate. If you are using an alternative MDM system you have to create a Certificate Signing Request (CSR) from your MDM and upload it to the Apple APNS portal to generate a push certificate.

Thanks for the information John. It does sounds like we have the same approach but are getting different results. Contrary to jjpotter's conclusion it does sound as though the APN provided profile can include a self-issued certificate. Our issue must be somewhere in the differences between your environment and ours. Is your profile manager server directly accessible from the internet?

Mine is currently on the internal tier and I'm able to access Apple services via firewall exceptions. Meaning contact from a device outside of our internal tier is not possible unless initiated from within the network.

tvieson wrote:

Thanks for the information John. It does sounds like we have the same approach but are getting different results. Contrary to jjpotter's conclusion it does sound as though the APN provided profile can include a self-issued certificate. Our issue must be somewhere in the differences between your environment and ours. Is your profile manager server directly accessible from the internet?

Mine is currently on the internal tier and I'm able to access Apple services via firewall exceptions. Meaning contact from a device outside of our internal tier is not possible unless initiated from within the network.

No, no an APNS certificate is never self-signed it is always signed by Apple as it is issued by them. Remember an APNS certificate is nothing directly to do with signing your profiles or acting as your server certificate. APNS is merely the Apple servers telling your client that there is a message i.e. profile waiting for them on your Profile Manager server. Your Profile Manager server would still be responsible for giving the profile to the client when it then 'phones home' to collect it.

Your original issue of profiles not being signed would be to do with possibly your code-signing certificate which as stated is nothing to do with Apple Push Notifications.

You can as I mentioned make your own self-signed code-signing certificate although as I also mentioned this is much harder than an ordinary server certificate.

I would turn off signing of profiles, reboot, and then try turning it back on and perhaps for paranoias sake rebooting again.

I only push my certificates. (Other than the initial enrolment.)

I'm having this problem as well.

Biggest difference is that my 'third party' domain and certs are from my local MS domain and CA.

I've had difficulty with many aspects of using Server as a MDM. Still don't have this functioning, yet.

(I would note that I've already reinstalled Server app completely to fix a broken PM web site and this still hasn't fixed everything)

From the Mydevices web page, the Trust and MDM profiles can be loaded, installed and show as verified. The installed/verified Trust profile does include both the Root CA and Code Signing certs.

Why, then, that the Enrollment Profile cannot install/verify from the Mydevices web page when it is signed by the same Code Signing certificate?

I can, however, log into the Profilemanager web page and download/install the profile and it will be verified. (??!!!)

Even so, I can't push any profile updates or install new software to the client, so it's use as a MDM is hamstrung.