I'm trying to provision an iOS device to be managed using the Apple MDM capabilities. Using the iPhone Configuration Utility, I'm trying to create a configuration profile. Under the Mobile Device Management section, I can setup everything except for the "Identity" entry, which always just says "Add credentials in the Credentials payload."

According to the iPhone Configuration Utility documentation for the Identity field:

Select the certificate that the device uses to identify itself to the MDM server. Add the certificate to the device using the Credentials Settings, or use SCEP Settings to provide instructions for the device to obtain the certificate using SCEP.

I don't have a SCEP server, so I'm trying to use a certificate. However, I can't figure out how to generate a valid certificate. No matter what certificate I add to the Credentials settings, it never becomes available for selection in the Identity field.

When I attempt to install the configuration profile without any identity certificate set, I get the error "Profile Failed to Install", and the Console shows the error "The identity certificate for com.test.test.mdm1 could not be found."

Has anyone succesfully provisioned a device for MDM using this system?

  • Are you using IPCU on a mac or windows OS? I've some familiarity on the former and might be able to help... – bmike Mar 5 '12 at 17:11

If you are using self-signed ssl then,While generating self-signed ssl certificate in server side,generate identity.p12 certificate and this certificate you need to use in identity section of IPCU. These few lines you can use to generate the idendtity.p12

//Creating the device Identity key and certificate request

openssl genrsa 2048 > identity.key
openssl req -new -key identity.key -out identity.csr

//Signing the identity key with the CA. 
//Give it a passphrase. You'll need to include that in the IPCU profile.

openssl x509 -req -days 365 -in identity.csr -CA cacert.crt -CAkey cakey.key -CAcreateserial -out identity.crt

openssl pkcs12 -export -out identity.p12 -inkey identity.key -in identity.crt -certfile cacert.crt

And go through this also.

  1. Contact your MDM vendor to request a signed Certificate Signing Request (CSR). Your vendor will sign a CSR and deliver it to you.
  2. Once you have a signed CSR from your vendor, visit identity.apple.com/pushcert and sign in with a verified Apple ID.
  3. Click "Create a Certificate” and agree to the Terms of Use.
  4. Select your signed CSR and click upload. After a moment, your certificate will be available for download.
  5. This certificate can now be uploaded to your MDM server for use with the Apple Push Notification service.

Are you sure that you don't just need to sign the cert?

  • I've tried using validly signed certificates and it doesn't seem to make a difference. – Chris Vasselli Jun 16 '11 at 18:01
  • How was your cert created and who signed it? – Jeff Jun 17 '11 at 2:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.