0

I am trying to follow the instructions for creating DEP Server Tokens in Apple's Device Enrollment Program manual ( https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/4-Profile_Management/ProfileManagement.html ) , but I don't really know how to "Generate a public/private key pair in PEM format for the MDM server"

I have a certificate from a trusted certificate authority, but how do I create the certificates from that ?

jacob
  • 1,397
  • 1
  • 26
  • 53

1 Answers1

1

The idea of a certificate for DEP is that Apple don't want to provide you the DEP token over SSL (unlike VPP token). To retrieve that, they ask that you provide a PEM formatted public key via their portal (this is basically any openssl self-signed cert, like so:

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

when uploading, use cert.pem file)

Then, when they return the result, use the private key to decrypt the CMS (PKCS7 Envelope):

openssl smime -decrypt -inform pem -in fileFromApple.p7 -inkey key.pem

Note that we use file from Apple and the key that we generated in the first command.

Note: it has been over a year since i've done this in practice, but in principal these commands should work.

zaitsman
  • 8,984
  • 6
  • 47
  • 79