generate MDM certificate

Question

I am new to iOS development. I have to create MDM certificate for utilize default iOS MDM capabilities.

I have gone through the documents ,how to generate APNS certificate for MDM Server,but I am not getting clear idea how to generate MDM Certificate which can be used to provide MDM service for all the devices registered with the MDM server.

Chrystalchryste

Have you completed the server setup successfully. If yes, can you help me with the identity part of the MDM payload? – Nutter

@Sahil go through #10293863 – Paly

@Sahil go through this also #9502920 – Paly

Answer 1

To MDM capabilities of iOS you need to get MDM certificate using your Enterprise developer account.The generated APNS certificate for MDM will be used as MDM certificate.You can get more details in third party MDM vendors site about how to generate MDM certificate. For example you can go through mcafee site or follow the below steps.

1)Follow MDM_Protocol pdf .

2)Follow this page: http://www.softhinker.com/in-the-news/iosmdmvendorcsrsigning

Then verify few things.

remove the passphrase from customerPrivateKey.pem using this command

openssl rsa -in customerPrivateKey.pem -out PlainKey.pem

Then merge your APNS certificate (for example CustomerCompanyName.pem) downloaded from the portal https://identity.apple.com/pushcert/ using this command

cat CustomerCompanyName.pem PlainKey.pem > PlainCert.pem

Now this PlainCert.pem file can be used in your server as APNS/MDM certificate.

3)For MDM config profile use IPCU and look in to this also.

Paly

Method 1) is not not used anymore. Method 2) I can vendor singing certificate OK. reference softhinker.com/in-the-news/iosmdmvendorcsrsigning but I do not know that make a .mobileconfig file. Method 1) Topic = com.apple.mgmt.[your unique reference] . Method 2) Topic = ?????? what can I use Topic and Identity in field Mobile Device Management Settings ? Somebody, help! – Matteson

Answer 2

There are 2 ways, both of which require an Enterprise developer account.

Method 1)

Log into the provisioning portal and create a new App ID in the format com.apple.mgmt.[your unique reference]. Then setup push notification for this new app. You don't need to actually create an app binary, but you can then use the push notification certificate to talk to APNS. The com.apple.mgmt.[your unique reference] value will be your push topic.

Method 2)

Follow the instructions here to create a vendor singing certificate.

Rappel

Unfortunately Apple have now blocked method 1. – Rappel