Not able to enroll iPhone in MDM in iOS 14 with Self signed certificate

Question

Created Sep ’20

Replies 2

Boosts 0

Views 3.3k

Participants 3

I have installed iOS14 on my iPhone and trying to enroll to a MDM server which has self signed certificate. The enrollment is throwing out an error that the server certificate is invalid.

I have already installed the trust profile which has the certificate and enable full trust under General - About - Certificate Trust Store settings.

The same device enrolls well when the device is on iOS 13.x but fails to enroll with iOS14.

Code Block iphone logs:
Install profile data, interactive error. Error: NSError:
Desc   : 描述文件安装失败
Sugg   : “https://192.168.22.30:443/iosapp/profile?tenant_id=mdm”的服务器证书无效。
US Desc: Profile Installation Failed
US Sugg: The server certificate for “https://192.168.22.30:443/iosapp/profile?tenant_id=mdm” is invalid.
Domain : MCInstallationErrorDomain
Code   : 4001
Type   : MCFatalError
...Underlying error:
NSError:
Desc   : “https://192.168.22.30:443/iosapp/profile?tenant_id=mdm”的服务器证书无效。
US Desc: The server certificate for “https://192.168.22.30:443/iosapp/profile?tenant_id=mdm” is invalid.
Domain : MCHTTPTransactionErrorDomain
Code   : 23002
Type   : MCFatalError
Params : (
    "https://192.168.22.30:443/iosapp/profile?tenant_id=mdm"
)
Extra info:
{
    isPrimary = 1;
}

Answered by sysedit in 635113022

Hi,

FQDN based certificates seem to work, only IP based self signed certs are not supported anymore.
According to the radar ticket we opened, this is due to changes announced in https://support.apple.com/en-us/HT210176.

We're seeing the same with macOS 11.

Boost

Answer 1

sysedit OP

Sep ’20

Accepted Answer

Hi,

FQDN based certificates seem to work, only IP based self signed certs are not supported anymore.
According to the radar ticket we opened, this is due to changes announced in https://support.apple.com/en-us/HT210176.

We're seeing the same with macOS 11.

0

Answer 2

Srikanth Gopalakrishnan OP

Oct ’20

I just tested with using Self signed certificate and having IP address it works in iOS 14.0.1 as usual. Can you check other parameters like

If self signed certificate should the have the IP address in SAN attribute of certificate
It should use SHA2 or higher algorithm and keysize 2048 or higher.
Expiry date should not be longer than 825 days.

0