I want to create a MDM server to manage my iOS devices. I have enrolled in iOS Enterprise Developer program. And executed the following openSSL commands
"1. Creating Certificate Authority (CA)"
openssl req -new -x509 -extensions v3_ca -keyout cakey.key -out cacert.crt -days 365
"2. Creating the Web Server private key and certificate request"
openssl genrsa 2048 > server.key
openssl req -new -key server.key -out server.csr
"3. Signing the server key with the CA. You'll the CA passphrase from step 1."
openssl x509 -req -days 365 -in server.csr -CA cacert.crt -CAkey cakey.key -CAcreateserial -out server.crt -extfile ./server.cnf -extensions ssl_server
"4. Creating the device Identity key and certificate request"
openssl genrsa 2048 > identity.key
openssl req -new -key identity.key -out identity.csr
"5. Signing the identity key with the CA. You'll the CA passphrase from step 1."
openssl x509 -req -days 365 -in identity.csr -CA cacert.crt -CAkey cakey.key -CAcreateserial -out identity.crt
openssl pkcs12 -export -out identity.p12 -inkey identity.key -in identity.crt -certfile cacert.crt
"6. Generating keys and certs for plist generation"
openssl req -inform pem -outform der -in identity.csr -out customer.der
I uploaded the generated identity.csr and got an MDM certificate.
With customer.der, AppleWWDRCA.cer, AppleIncRootCertificate.cer, MDM.cer (obtained from iOS Enterprise Developer) and with Identity.p12 I created a Java code to generate encoded plist file. I used this file and got APNSPushCert. It worked fine.
Now the problem is that the IP address of the computer got changed and I don't want to create the new MDM Vendor certificate.
As I understand the only place I mention the IP is server.cnf. I changed the IP in server.cnf and executed all the commands except 4. I placed the identity.key and identity.csr in the same folder before executing. Now every thing works fine but when I upload the encoded plist file for getting APNSPushCert site says Certificate Signature Verification failed.
I really don't understand what went wrong.
This is something to do with the SSL certificate you are using. It always validates the common name in the device side. You have to use either you domain name or the ip address of your server under common name of SSL certificate. Make sure it doesnt change. If it changes binding it to a DNS will work.
I tried to copy the same .der (costomer.der) file too and recompiled the program again. Now it is working fine. Also, I used DNS resolvable name as URI. Now all these are working fine.
Related
For testing purposes, I need a revoked PEM certificate.
So I created a certificate:
Generate CSR & KEY: openssl req -new -newkey rsa:4096 -nodes -keyout test.key -out test.csr
Generate PEM and self-sign with KEY: openssl x509 -req -sha256 -days 365 -in test.csr -signkey test.key -out test.pem
When I try to revoke with openssl -revoke a get an error variable lookup failed
How can I revoke this certificate?
I am building a command line script to create a client certificate using OpenSSL "mini CA" feature.
I have a CA certificate and CA private key encrypted with a password. With those things I am trying to create the client certificate and stumbled upon the command line syntax. How do I specify the password for the CA's private key?
So far, I have ...
openssl x509
-req
-in client.csr
-signkey client.key
-passin pass:clientPK
-CA client-ca.crt
-CAkey client-ca.key
-CAkeypassin pass:client-caPK <-- does not work
-CAcreateserial
-out client.crt
-days 365
See the highlighted parameter. I expect something like this, but I cannot find it anywhere in the docs.
Corrected
Just for the records. The -signkey parameter is used for self signed certificates. CA's don't have access to the client's private key and so will not use this. Instead the -passin parameter refers to the CA's private key.
openssl x509
-req
-in client.csr
-CA client-ca.crt
-CAkey client-ca.key
-passin pass:CAPKPassword
-CAcreateserial
-out client.crt
-days 365
Use -passin pass as shown below.
openssl x509
-req
-in client.csr
-signkey client.key
-passin pass:clientPK
-CA client-ca.crt
-CAkey client-ca.key
-passin pass:secret <-- try this
-CAcreateserial
-out client.crt
-days 365
I am trying this for the past week. I dont know where I am going wrong. I want to setup a MDM server that dont have static IP. I have a DNS resolvable name for the server. I have the identity.key and identity.csr for which I created the MDM vendor certificate. I wrote a following .bat file to generate other certificates
echo 1. Creating Certificate Authority (CA)
echo For 'Common Name' enter something like 'MDM Test CA
openssl req -new -x509 -extensions v3_ca -keyout cakey.key -out cacert.crt -days 365
echo 2. Creating the Web Server private key and certificate request
echo For 'Common Name' enter your server's DNS Name
openssl genrsa 2048 > server.key
openssl req -new -key server.key -out server.csr
echo 3. Signing the server key with the CA. You'll the CA passphrase from step 1.
openssl x509 -req -days 365 -in server.csr -CA cacert.crt -CAkey cakey.key -CAcreateserial -out server.crt -extfile .\server.cnf -extensions ssl_server
echo 4. Signing the identity key with the CA. You'll the CA passphrase from step 1.
echo Give it a passphrase. You'll need to include that in the IPCU profile
openssl x509 -req -days 365 -in identity.csr -CA cacert.crt -CAkey cakey.key -CAcreateserial -out identity.crt
openssl pkcs12 -export -out identity.p12 -inkey identity.key -in identity.crt -certfile cacert.crt
I used the identity.p12 file and created a encoded plist file for which push notification certificate is created. I also create a MDM profile in IPCU with the identity.p12 file. When I try to install the MDM profile, the mobile console says "Certificate in the server is invalid" and in the server it says SSL handshake failed and the server gets hanged.
What might be the issue?
In server.cnf -> subjectAltName I gave a parameter named DNS with DNS resolvable name and removed the IP. Now it is working fine.
My Configuration Profile with MDM Payload not getting installed using IPCU，I have a P12 file， Did the P12 file have any relationship with the check-in server? And how to deploy a MDM check-in server to solve the problem?
Yes, the identity.p12 should related to your server.Your server link must start with "https"
If you are using self-signed ssl then,While generating self-signed ssl certificate in server side,generate identity.p12 certificate and this certificate you need to use in identity section of IPCU and use the same password also.
These few lines you can use to generate the idendtity.p12
//Creating the device Identity key and certificate request
openssl genrsa 2048 > identity.key
openssl req -new -key identity.key -out identity.csr
//Signing the identity key with the CA.
//Give it a passphrase. You'll need to include that in the IPCU profile.
openssl x509 -req -days 365 -in identity.csr -CA cacert.crt -CAkey cakey.key -CAcreateserial -out identity.crt
openssl pkcs12 -export -out identity.p12 -inkey identity.key -in identity.crt -certfile cacert.crt
To deploy the server go through MDM_Protocol pdf in which sample server details is there.
I am trying to convert an Apple Push Certificate (received in .pem format from https://identity.apple.com/pushcert/) to PKCS12 on a Windows machine. I have OpenSSL installed.
Here are the steps I am trying:
Generate CSR
openssl req -out d:\cert\request.csr -new -newkey rsa:2048 -nodes -keyout d:\cert\csrPrivateKey.pem
Upload signed CSR to Apple and download issued certificate (pushCert.pem)
Convert .pem certificate to pkcs12
openssl pkcs12 -export -in d:\cert\pushCert.pem -inkey d:\cert\csrPrivateKey.pem -out d:\cert\pushCert.p12 -name "apns-cert"
When I try this last step, I get an error "No certificate matches private key" and an empty file is created. If anyone has any suggestions it would be greatly appreciated.
Thanks!