Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to provision an iOS device to be managed using the Apple MDM capabilities. Using the iPhone Configuration Utility, I'm trying to create a configuration profile. Under the Mobile Device Management section, I can setup everything except for the "Identity" entry, which always just says "Add credentials in the Credentials payload."

According to the iPhone Configuration Utility documentation for the Identity field:

Select the certificate that the device uses to identify itself to the MDM server. Add the certificate to the device using the Credentials Settings, or use SCEP Settings to provide instructions for the device to obtain the certificate using SCEP.

I don't have a SCEP server, so I'm trying to use a certificate. However, I can't figure out how to generate a valid certificate. No matter what certificate I add to the Credentials settings, it never becomes available for selection in the Identity field.

When I attempt to install the configuration profile without any identity certificate set, I get the error "Profile Failed to Install", and the Console shows the error "The identity certificate for com.test.test.mdm1 could not be found."

Has anyone succesfully provisioned a device for MDM using this system?

share|improve this question
Are you using IPCU on a mac or windows OS? I've some familiarity on the former and might be able to help... – bmike Mar 5 '12 at 17:11
up vote 11 down vote accepted

If you are using self-signed ssl then,While generating self-signed ssl certificate in server side,generate identity.p12 certificate and this certificate you need to use in identity section of IPCU. These few lines you can use to generate the idendtity.p12

//Creating the device Identity key and certificate request

openssl genrsa 2048 > identity.key
openssl req -new -key identity.key -out identity.csr

//Signing the identity key with the CA. 
//Give it a passphrase. You'll need to include that in the IPCU profile.

openssl x509 -req -days 365 -in identity.csr -CA cacert.crt -CAkey cakey.key -CAcreateserial -out identity.crt

openssl pkcs12 -export -out identity.p12 -inkey identity.key -in identity.crt -certfile cacert.crt

And go through this also.

share|improve this answer
  1. Contact your MDM vendor to request a signed Certificate Signing Request (CSR). Your vendor will sign a CSR and deliver it to you.
  2. Once you have a signed CSR from your vendor, visit and sign in with a verified Apple ID.
  3. Click "Create a Certificate” and agree to the Terms of Use.
  4. Select your signed CSR and click upload. After a moment, your certificate will be available for download.
  5. This certificate can now be uploaded to your MDM server for use with the Apple Push Notification service.
share|improve this answer

Are you sure that you don't just need to sign the cert?

share|improve this answer
I've tried using validly signed certificates and it doesn't seem to make a difference. – Chris Lindsay Jun 16 '11 at 18:01
How was your cert created and who signed it? – Jeff Jun 17 '11 at 2:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.