iossslssl-certificatemdmapple-vpp

Generate a public/private key pair in PEM format

I am trying to follow the instructions for creating DEP Server Tokens in Apple's Device Enrollment Program manual ( https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/4-Profile_Management/ProfileManagement.html ) , but I don't really know how to "Generate a public/private key pair in PEM format for the MDM server"

I have a certificate from a trusted certificate authority, but how do I create the certificates from that ?

Solution

  • The idea of a certificate for DEP is that Apple don't want to provide you the DEP token over SSL (unlike VPP token). To retrieve that, they ask that you provide a PEM formatted public key via their portal (this is basically any openssl self-signed cert, like so:

    openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

    when uploading, use cert.pem file)

    Then, when they return the result, use the private key to decrypt the CMS (PKCS7 Envelope):

    openssl smime -decrypt -inform pem -in fileFromApple.p7 -inkey key.pem

    Note that we use file from Apple and the key that we generated in the first command.

    Note: it has been over a year since i've done this in practice, but in principal these commands should work.