I'm trying to provision an iOS device to be managed using the Apple MDM capabilities. Using the iPhone Configuration Utility, I'm trying to create a configuration profile. Under the Mobile Device Management section, I can setup everything except for the "Identity" entry, which always just says "Add credentials in the Credentials payload."

According to the iPhone Configuration Utility documentation for the Identity field:

Select the certificate that the device uses to identify itself to the MDM server. Add the certificate to the device using the Credentials Settings, or use SCEP Settings to provide instructions for the device to obtain the certificate using SCEP.

I don't have a SCEP server, so I'm trying to use a certificate. However, I can't figure out how to generate a valid certificate. No matter what certificate I add to the Credentials settings, it never becomes available for selection in the Identity field.

When I attempt to install the configuration profile without any identity certificate set, I get the error "Profile Failed to Install", and the Console shows the error "The identity certificate for com.test.test.mdm1 could not be found."

Has anyone succesfully provisioned a device for MDM using this system?

  • Are you using IPCU on a mac or windows OS? I've some familiarity on the former and might be able to help...
    – bmike
    Mar 5, 2012 at 17:11

3 Answers 3


If you are using self-signed ssl then,While generating self-signed ssl certificate in server side,generate identity.p12 certificate and this certificate you need to use in identity section of IPCU. These few lines you can use to generate the idendtity.p12

//Creating the device Identity key and certificate request

openssl genrsa 2048 > identity.key
openssl req -new -key identity.key -out identity.csr

//Signing the identity key with the CA. 
//Give it a passphrase. You'll need to include that in the IPCU profile.

openssl x509 -req -days 365 -in identity.csr -CA cacert.crt -CAkey cakey.key -CAcreateserial -out identity.crt

openssl pkcs12 -export -out identity.p12 -inkey identity.key -in identity.crt -certfile cacert.crt

And go through this also.

  1. Contact your MDM vendor to request a signed Certificate Signing Request (CSR). Your vendor will sign a CSR and deliver it to you.
  2. Once you have a signed CSR from your vendor, visit identity.apple.com/pushcert and sign in with a verified Apple ID.
  3. Click "Create a Certificate” and agree to the Terms of Use.
  4. Select your signed CSR and click upload. After a moment, your certificate will be available for download.
  5. This certificate can now be uploaded to your MDM server for use with the Apple Push Notification service.

Are you sure that you don't just need to sign the cert?

  • I've tried using validly signed certificates and it doesn't seem to make a difference. Jun 16, 2011 at 18:01
  • How was your cert created and who signed it?
    – Jeff
    Jun 17, 2011 at 2:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .