“ACME Certificate” payload contains an invalid value for the key “HardwareBound”

Question

MDM iOS Dev OP

Created Oct ’22

Replies 2

Boosts 0

Views 1.2k

Participants 3

We are testing the ACMECertificate payload in Mac 13.1 beta and getting this error.

The same payload when sent to iOS works fine.

Any help on this would be appreciated. Thanks.

FB Raised: FB11736586

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadUUID</key>
    <string>70e4b45e3c1e</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadOrganization</key>
    <string>NewComp</string>
    <key>PayloadIdentifier</key>
    <string>4565353a3a84</string>
    <key>PayloadDisplayName</key>
    <string>ACME</string>
    <key>PayloadRemovalDisallowed</key>
    <true/>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadUUID</key>
            <string>f84ef110e39b</string>
            <key>PayloadType</key>
            <string>com.apple.security.acme</string>
            <key>PayloadOrganization</key>
            <string>NewComp</string>
            <key>PayloadIdentifier</key>
            <string>f84ef110e39b</string>
            <key>PayloadDisplayName</key>
            <string>ACME Configuration</string>
            <key>DirectoryURL</key>
            <string>https://acmeserver/acme/acme/directory</string>
            <key>ClientIdentifier</key>
            <string>test</string>
            <key>HardwareBound</key>
            <true/>
            <key>KeyType</key>
            <string>ECSECPrimeRandom</string>
            <key>KeySize</key>
            <integer>384</integer>
            <key>Subject</key>
            <array>
                <array>
                    <array>
                        <string>1.2.840.113549.1.9.1</string>
                        <string>test@test.com</string>
                    </array>
                </array>
            </array>
            <key>SubjectAltName</key>
            <dict>
            </dict>
            <key>KeyUsage</key>
            <integer>5</integer>
            <key>Attest</key>
            <true/>
        </dict>
    </array>
</dict>
</plist>

Answered by Device Management Engineer in 734626022

macOS does not support hardware-bound keys or attestation.

Boost

Answer 1

Device Management Engineer OP

Apple

Oct ’22

Accepted Answer

macOS does not support hardware-bound keys or attestation.

2

Answer 2

hslatman- OP

Dec ’22

Will it be supported (soon)?

I'm also testing the ACME certificate payload. Not receiving the attestation payload in the ACME request significantly reduces the utility of the payload. E.g. there's no evidence the key is protected, no assurance this is a known Apple device, etc.

0