Home/ Questions/Q 8123309
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-06T06:08:20+00:00

I am working on an Apple MDM server, and actually it is working fine.

  • 0

I am working on an Apple MDM server, and actually it is working fine. I have a signature problem, that makes the client complain about the certificate, so now I am interested in how others sign their configuration profiles.

I use java, but any kind of help is welcome, since this is not a particular question on how to implement the code in java, but more on how to correctly sign the configuration profile.

This is how we do it currently:

byte[] data = ...
X509Certificate cert = ...
KeyPair keyPair = ...
CMSSignedDataGenerator gen = new CMSSignedDataGenerator();          
gen.addSigner(keyPair.getPrivate(), cert, CMSSignedGenerator.DIGEST_SHA1, new AttributeTable(new Hashtable<DERObjectIdentifier, Attribute>()), null);
CMSSignedData signedData = gen.generate(new CMSProcessableByteArray(data), true, "BC");

response.setContentType("application/x-apple-aspen-config");
response.getOutputStream().write(signedData.getEncoded());

We are using a self signed certificate created with the algorithm SHA1withRSA and the key is with RSA and the size is 2048.

Does anyone see a problem with this way of doing it, or are you just doing it differently which maes it work?

And please feel free to post code in other languages than java – it might still help.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I did two things to fix this.
    First I changed the certificate to x509 v3 – it was v1. Then I added KeyUsage and BasicConstraints to make iOS accept it as trusted.
    The second I did was to add the certificate itself as a CertStore.
    These two steps makes the certificate similar to the certificate iPhone Configuration Utility uses.

    • 0