OS x device enroll to MDM using SCEP

Asked Mar 11 '16 at 07:26

Active Oct 09 '20 at 08:29

Viewed 1,308 times

I am able to enroll an OS x device to MDM without going through the scep. When I go through some documentation there are no any specific different between ios and os x enrollment via SCEP. But when I tried to enroll an OS x device using SCEP I got the below error.

The profile could not be installed due to an unexpected error.
<NSOStatusErrorDomain:-25300>

Can you please help me to solve this out!
Thanks.

asked Mar 11 '16 at 07:26

Tharinda Ehelepola

1

What do your console logs show? Did you capture your traffic? Which scep operation fails? – zaitsman Mar 12 '16 at 01:38
It was failed in the first scep request. Can we used the same implementation for both ios and os x device or is there any deference? – Tharinda Ehelepola Mar 12 '16 at 12:20
1

Did you check that the ca certs are returned correctly, contain the root cert and are valid as per computer's date time? – zaitsman Mar 13 '16 at 00:02
1. hit correctly to profile url 2. hit to scep and request GET CA CAPS. Server responded 3. hit to scep and request GET CA CERT. Server responded. above error occurred from the device – Tharinda Ehelepola Mar 14 '16 at 05:54
1

Yeh so it means that the device didnt like you CA/RA bundle – zaitsman Mar 14 '16 at 12:42
So what should I do. But it works for ios devices. – Tharinda Ehelepola Mar 14 '16 at 12:48
1

what do the console logs say? – zaitsman Mar 14 '16 at 12:49
Do you mean the server side or device side? – Tharinda Ehelepola Mar 14 '16 at 12:51
1

Device side https://support.omnigroup.com/console-osx/ – zaitsman Mar 14 '16 at 12:56
for the device side error can be found on below link https://docs.google.com/document/d/1nnxCcFi21zMuFFqaoaB_debAtrGizD98TXGC7gjmP0c/edit?usp=sharing – Tharinda Ehelepola Mar 14 '16 at 12:56
1

Well more or less this just confirms the same thing.. 25300 means 'key not found' Ensure that you have at least 3 certificates in the CA/RA bundle (all the way to the root) and the pair of certs for RA have correct key usage; check that the certs are within validity; check that machine date/time is correct – zaitsman Mar 14 '16 at 13:03
I rechecked the certificates. But those are valid. :( – Tharinda Ehelepola Mar 14 '16 at 13:34
Were able to find the rootcause of the issue? @TharindaEhelepola – user2421978 Oct 09 '20 at 08:29

OS x device enroll to MDM using SCEP

0 Answers0