I'm having an issue starting the Remote Control and Spy sessions using the Quamotion WebDriver on an iPad Mini 4 running iOS 10.2.1.
I'm getting the following error message:
The spy failed to start. The installation of application Quamotion Agent on device iPad failed. The installation proxy returned the error ApplicationVerificationFailed. The following syslog messages may contain more information:
0x16df1b000 -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/var/mobile/Media/PublicStaging/com.apple.test.WebDriverAgentRunner-Runner" type Customer (LSInstallType = (null)) requested by mobile_installation_proxy (pid 203) 0x16df1b000 -[MIInstaller performInstallationWithError:]: Installing :Install (New):0:Success:Begin could not enable test hierarchy: ApplePinningAllowTestCertsiPhoneApplicationSigning not true [leaf CheckLeafMarkerOid IssuerCommonName Revocation1 SubjectCommonName] could not enable test hierarchy: ApplePinningAllowTestCertsiPhoneApplicationSigning not true [leaf CheckLeafMarkerOid IssuerCommonName Revocation1 SubjectCommonName] [leaf Revocation1] 0x16df1b000 +[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:]: 147: Failed to verify code signature of /private/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.N6uppO/extracted/Payload/WebDriverAgentRunner-Runner.app : 0xe8008018 (The identity used to sign the executable is no longer valid.) 0x16df1b000 -[MIInstaller performInstallationWithError:]: Verification stage failed :Install (New):0:Fail:End
Are there any steps I can take to troubleshoot this? I can start the Spy and remote control on an iPhone 6.
This most likely indicates that the iOS Developer Certificates you have uploaded in the Quamotion Settings page have been revoked.
You can check the revocations tate of your iOS developer certificate using the following command:
openssl ocsp -issuer AppleWWDRCA.pem -cert mycert.pem -text -url http://ocsp.apple.com/ocsp03-wwdr01 -header 'host' 'ocsp.apple.com'
You can download the individual certificates in .cer format from the Settings page in the Quamotion WebDriver. You can then convert the .cer file to .pem file using the following OpenSSL command:
openssl x509 -inform der -in mycert.cer -out mycert.pem
You'll also need the Apple WWDR CA certificate, which you can download from https://developer.apple.com/certificationauthority/AppleWWDRCA.cer .
If your certificate has been revoked, you should get a status message simliar to this:
Response Verify Failure
140404648445600:error:27069065:OCSP routines:OCSP_basic_verify:certificate
verify error:ocsp_vfy.c:126:Verify error:self signed certificate in certificate chain
mycert.pem: revoked
This Update: Mar 14 10:10:08 2018 GMT
Next Update: Mar 15 10:10:08 2018 GMT
Reason: keyCompromise
Revocation Time: Jan 23 08:33:40 2018 GMT
Related
I am doing a MDM vendor set up and having apple enterprise account for the same.But after completing all the steps I am getting an issue when I try to install the iPhone Configuration Utility file on the iPhone.We are getting an alert saying “Profile Installation Failed”.Please suggest what you suspect may be wrong.Following are the steps I followed for my profile creation.
For Vendor:
I created my vendor csr on my macbook called vendor.csr.
Email: My Enterprise Account Email.
Common Name: My Company Name.
Saved to Disk.
Uploaded the vendor.csr file to the enterprise account and downloaded the mdm.cer file from the account.
Loaded this certificate to the key chain.
Exported the .p12 file as private.p12 file.
Extracted Private key using command : openssl pkcs12 -in private.p12 -nocerts -out key.pem
Extracted Certificate : openssl pkcs12 -in private.p12 -clcerts -nokeys -out cert.pem
Convert the certificate to des form : openssl x509 -in cert.pem -inform PEM -out mdm.cer -outform DES
8.Stripped password from private key : openssl rsa -in key.pem -out private.key
For customer:
Now I created one more csr for push from the same macbook called push.csr.
Email: Company Support Email.
Common Name : Company Name Push
Saved to Disk.
Python Code :
Link: https://github.com/grinich/mdmvendorsign
I got the python code from the above link to get the plist encoded file from the files I generated above i.e. private.key, push.csr, mdm.cer.I renamed my files according to the command below and generated a plist encoded file.
Command : python mdm_vendor_sign.py --csr user_submitted_CSR.csr --key mdm_vendor_private.key --mdm mdm_certifiate_from_apple.cer
Push Cert :
Then I uploaded a plist encoded file on “https://identity.apple.com/pushcert/” and downloaded the resulting push certificate from there.
Installed the pushcert downloaded to the key chain and exported it in the p12 format and call it mdm.p12.
Converted the mdm.p12 to PEM format : openssl pkcs12 -in mdm.12 -out pushcert.pem -nodes
iPhone Configuration Utility :
I implemented three sections of iPCU. For server setup I am using RapidSSL for my server set up.
General
a. Name : My Company Private Limited
b. Identifier: com.mycompany.mdm.profile
c. Organization : My Company Name
d. Description : Version 1.0
e. Security : Always.
Credentials
Uploaded the pushcert.pem file generated at the last step of push cert work.
Mobile Device Management
a. Server URL : https://xyz.server
b Check In URL : https://xyz.checin
c. Topic :com.apple.mgmt.External.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
d. Identity : selected from credential.
Export iPCU -> None/SignConfigurationProfile (tried both).
Now this file is failing to install on the device when I send it through mail and I am getting message profile installation failed.What I understand from logs that the device is unable to make connection to the server.please suggest me how could I resolve that.
Device Logs:
Nov 27 19:02:21 iPhone profiled[114] <Notice>: (Note ) MC: Checking for MDM installation...
Nov 27 19:02:21 iPhone profiled[114] <Notice>: (Note ) MC: ...finished checking for MDM installation.
Nov 27 19:02:21 iPhone profiled[114] <Notice>: (Note ) MC: Beginning profile installation...
Nov 27 19:02:21 iPhone profiled[114] <Error>: SecTrustEvaluate [leaf AnchorTrusted]
Nov 27 19:02:23 iPhone locationd[63] <Notice>: Gesture EnabledForTopCLient: 0, EnabledInDaemonSettings: 0
Nov 27 19:02:24 iPhone locationd[63] <Notice>: Gesture EnabledForTopCLient: 0, EnabledInDaemonSettings: 0
Nov 27 19:02:24 iPhone profiled[114] <Error>: SecTrustEvaluate [leaf AnchorTrusted]
Nov 27 19:02:26 iPhone profiled[114] <Notice>: (Error) MDM: Cannot Authenticate. Error: NSError:
Desc : A connection to the server could not be established.
US Desc: A connection to the server could not be established.
Domain : MCHTTPTransactionErrorDomain
Code : 23001
Type : MCFatalError
Params : (
"https://mdm.myCompanyName.com/Service1.svc",
500
)
Nov 27 19:02:26 iPhone profiled[114] <Notice>: (Error) MC: Cannot install MDM “Mobile Device Management”. Error: NSError:
Desc : The payload “Mobile Device Management” could not be installed.
Sugg : A connection to the server could not be established.
US Desc: The payload “Mobile Device Management” could not be installed.
US Sugg: A connection to the server could not be established.
Domain : MCInstallationErrorDomain
Code : 4001
Type : MCFatalError
Params : (
"Mobile Device Management"
)
...Underlying error:
NSError:
Desc : A connection to the server could not be established.
US Desc: A connection to the server could not be established.
Domain : MCHTTPTransactionErrorDomain
Code : 23001
Type : MCFatalError
Params : (
"https://mdm.myCompanyName.com/Service1.svc",
500
)
Nov 27 19:02:26 iPhone profiled[114] <Notice>: (Error) MC: Rolling back installation of profile “com.myCompanyName.mdm.profile”...
Nov 27 19:02:26 iPhone profiled[114] <Notice>: (Error) MC: Installation of profile “com.myCompanyName.mdm.profile” failed with error: NSError:
Desc : The profile “myCompanyName” could not be installed.
Sugg : The payload “Mobile Device Management” could not be installed.
US Desc: The profile “myCompanyName” could not be installed.
US Sugg: The payload “Mobile Device Management” could not be installed.
Domain : MCProfileErrorDomain
Code : 1009
Type : MCFatalError
Params : (
"myCompanyName"
)
The certificate you generated with your MDM vendor cert from Apple isn't used for device authentication. It's used for that particular server to send notifications to APNs.
The identity in iPCU (Which was deprecated long ago) is for a client certificate. Also remember that all TLS certificates need to be valid and trusted. Your server is rejecting the client with a HTTP 500, so I would start investigating the server logs as to why.
Really though if you are developing your own MDM solution I would open a DTS incident with Apple. The API documents are only published to folks in the Enterprise Developer Program and not publicly available. Rather than here, the MDM section of the Apple Developer Forums is probably a better place to discuss it.
I have done this a dozen times successfully and cannot figure out what is wrong for this instance. I created the deployment certificate, added my devices, and then created my ad-hoc profile using the deployment cert and all devices.
I have a website that allows the user to install the profile and app. The app starts to install and gets to where it is almost done and then it just sits there. It fails for all devices with different flavors of iOS on them.
Any ideas what could be wrong? This is the console output where (altered) line 3 is bugging me. I think this is the primary failure point and I am investigating further. It works fine from my desktop.
Aug 5 09:08:29 MFI-Test-iPad-Mini installd[62] <Notice>: 0x3cf000 MobileInstallationInstall_Server: Installing app com.marketforce.Auditor
Aug 5 09:08:36 MFI-Test-iPad-Mini profiled[213] <Notice>: (Note ) profiled: Service stopping.
Aug 5 09:08:37 MFI-Test-iPad-Mini securityd[78] <Notice>: http asynchttp_timer_proc Timeout during GET http://ocsp.apple.com/ocsp-wwdr01/ThisHasBeenChangedInTheInterestOfSecurity%2BThisHasAlsoBeenAlteredForSecuritym67h1P0%3D.
Aug 5 09:08:37 MFI-Test-iPad-Mini installd[62] <Error>: entitlement 'keychain-access-groups' has value not permitted by provisioning profile 'Adhoc Distribution'
Aug 5 09:08:37 MFI-Test-iPad-Mini installd[62] <Error>: 0x3cf000 verify_signer_identity: MISValidateSignatureAndCopyInfo failed for /var/tmp/install_staging.nkJObR/foo_extracted/Payload/Auditor.app/Auditor: 0xe8008016
Aug 5 09:08:37 MFI-Test-iPad-Mini installd[62] <Error>: 0x3cf000 do_preflight_verification: Could not verify executable at /var/tmp/install_staging.nkJObR/foo_extracted/Payload/Auditor.app
Aug 5 09:08:37 MFI-Test-iPad-Mini installd[62] <Error>: 0x3cf000 install_application: Could not preflight application install
Aug 5 09:08:37 MFI-Test-iPad-Mini itunesstored[89] <Error>: 0x1c3e000 MobileInstallationInstallForLaunchServices: failed with -1
Aug 5 09:08:37 MFI-Test-iPad-Mini itunesstored[89] <Warning>: ERROR: MobileInstallationInstallForLaunchServices returned nil
Aug 5 09:08:37 MFI-Test-iPad-Mini lsd[166] <Warning>: LaunchServices: installation failed for app com.marketforce.Auditor
Aug 5 09:08:37 MFI-Test-iPad-Mini itunesstored[89] <Warning>: LaunchServices: installPhaseFinishedForProgress: com.marketforce.Auditor.Installing - <NSProgress: phase=Installing; state=Failed;
When I hit ad-hoc distribution errors, I have a couple troubleshooting steps to try to narrow it down.
Can you install just the provisioning profile? You should have either a developer or a distribution profile (depending, often times I install both to be sure).
Can you install the app via the iPhone Configuration Utility?
Answering those two questions will point you in the right direction at least. Good luck!
The app was originally created under a developer's appleID and the published in the Business To Business site. The developer left the company and the company created an appleID to be used for the company's development purposes. (Which is what should have been done to begin with).
The app was then transferred to the company's ID however the transfer didn't work right as it left the AppID under the old developer account so any attempt to use certificates and profiles against either account was doomed to failure while using the original AppID. To do any sort of internal deployment, a different AppID had to be created.
After Apple finally got the app transfer fully complete, all was good and the original AppID could once again be used.
I had many times making a developer builds for testing purpose and everything was working fine. Was! After updating my Xcode to version 4.5 I can't install my developer builds via iTunes.
This situation is the same on every device I had in provision profile.
What I have and what I had checked double times with other developers to avoid personal mistake:
1) developer certificate
2) developer provision profile with added right devices
3) right build process
After success build of app me and other developers try to install it via iTunnes (10.7) but only error dialog appears that Synchronisation failed.
The very important info is, that I can build runnable app in xCode 4.2 and install it via iTunnes without any troubles with the same certificate and provision profiles
I can run the app directly on device if I run it via Xcode
Checked all apple's recommendation and I have all right: https://developer.apple.com/library/ios/#technotes/tn2009/tn2242.html
Checked lots of forums with similar issue and I have done many steps trying to reduce this problem starting with revoking ALL certificates, making new developers profiles with particular devices, cleaned tmp folders in Xcode together with build dir. I had delete all certificates, keys from KeyChain and import new ones. Deleted all provision profiles on device and install new one. Clean project, change a build architecture "armv", base SDK - Latest iOS 6.
Many thanks for your responce!!!
This is a part of log file from device (iPhone5 iOS 6.1)
Nov 7 23:31:04 lockdownd[29] <Notice>: 016ca000 __copy_itunes_value_block_invoke_0: com.apple.mobile.iTunes.store/PurchaseTypes -> (null)
Nov 7 23:31:09 installd[31] <Error>: 0x343000 handle_install: Install of "/var/mobile/Media/PublicStaging/denik4.ipa" requested by itunesstored
Nov 7 23:31:09 installd[31] <Error>: 0x343000 MobileInstallationInstall_Server: Installing app cz.newslab.denik
>
Nov 7 23:31:09 installd[31] <Error>: profile not valid: 0xe8008012
>
Nov 7 23:31:09 installd[31] <Error>: 0x343000 install_embedded_profile: Could not install embedded profile: 0xe8008012
>
Nov 7 23:31:09 installd[31] <Error>: Nov 7 23:31:09 SecTrustEvaluate [leaf CriticalExtensions IssuerCommonName]
>
Nov 7 23:31:09 mobile_assertion_agent[94] <Notice>: service_one_connection: Connection closed for client iTunes.
>
Nov 7 23:31:10 installd[31] <Error>: entitlement 'keychain-access-groups' has value not permitted by a provisioning profile
>
Nov 7 23:31:10 installd[31] <Error>: entitlement 'aps-environment' has value not permitted by a provisioning profile
>
Nov 7 23:31:10 installd[31] <Error>: entitlement 'application-identifier' has value not permitted by a provisioning profile
>
Nov 7 23:31:10 installd[31] <Error>: 0x343000 verify_signer_identity: MISValidateSignatureAndCopyInfo failed for /var/tmp/install_staging.yDZPNm/foo_extracted/Payload/denik.app/denik: 0xe8008016
>
Nov 7 23:31:10 installd[31] <Error>: 0x343000 do_preflight_verification: Could not verify executable at /var/tmp/install_staging.yDZPNm/foo_extracted/Payload/denik.app
>
Nov 7 23:31:10 installd[31] <Error>: 0x343000 install_application: Could not preflight application install
>
Nov 7 23:31:10 itunesstored[66] <Error>: 0x1786000 MobileInstallationInstall: failed with -1
>
Nov 7 23:31:10 installd[31] <Error>: 0x343000 handle_install: API failed
The important line is this one:
installd[31] : profile not valid: 0xe8008012
I've seen this error myself with one of our IPAs recently. It was solved by re-issuing the profile from the iOS Provisioning portal (simply make a simple change, undo it, then submit - that should regenerate the profile), updated the Xcode code signing identity to use the new profile, rebooted the device, and then tried again. It then seemed to install fine.
We weren't able to close in on a root cause of the issue, but once we'd gone through those steps we haven't seen it again.
Developed my first iPhone app for internal use and it should be distributed internally.
I am able to successfully install it on to the device when I code sign the build with my developer profile. But not able to install the same app(.ipa) using iTunes when code sign the build with App store distribution profile. I am getting the following error.
Oct 1 15:52:32 unknown installd[462] <Error>: profile not valid: 0xe8008012
Oct 1 15:52:32 unknown installd[462] <Error>: 001d7000 install_embedded_profile: Could not install embedded profile: -402620398
Oct 1 15:52:32 unknown installd[462] <Error>: 001d7000 verify_signer_identity: Could not copy validate signature: -402620395
Oct 1 15:52:32 unknown installd[462] <Error>: 001d7000 preflight_application_install: Could not verify executable at /var/tmp/install_staging.1JP9zU/foo_extracted/Payload/mi-ios.app
Oct 1 15:52:32 unknown installd[462] <Error>: 001d7000 install_application: Could not preflight application install
Oct 1 15:52:32 unknown installd[462] <Error>: 001d7000 handle_install: API failed
Oct 1 15:52:32 unknown installd[462] <Error>: 001d7000 send_message: failed to send mach message of 71 bytes: 10000003
Oct 1 15:52:32 unknown installd[462] <Error>: 001d7000 send_error: Could not send error response to client
I made sure the distribution profile is valid(have private key and certificate installed on my mac).
I am not sure what i am missing here. I followed every step given at iOS dev center. Any help would be appreciated.
The App Store profile is, as its name implies, for use only when distributing via the App Store. It exists for signing your app for distribution via the App Store and can't be used for any other purpose. Unless you install an app that has been signed by it via the App Store it will, quite correctly, fail.
If you want to distribute an app for internal use to a few devices and for a relatively short period, you should use an ad hoc profile; if to a lot if users for an extended period, you need to register as a corporate developer and follow a different process.
I'm an experiencing an issue where I can't install an Ad Hoc version of my application via TestFlight. The application downloads, but at the installation step it shows something like "YourApp can't be installed", with the following messages appearing on the console:
Sep 17 16:08:24 unknown installd[4767] <Error>: 00381000 verify_signer_identity: Could not copy validate signature: -402620393
Sep 17 16:08:24 unknown installd[4767] <Error>: 00381000 preflight_application_install: Could not verify executable at /var/tmp/install_staging.2wYy1J/foo_extracted/Payload/PocketCASbeta.app
Sep 17 16:08:24 unknown com.apple.itunesstored[4764] <Notice>: MobileInstallationInstall: failed with -1
Sep 17 16:08:24 unknown installd[4767] <Error>: 00381000 install_application: Could not preflight application install
Sep 17 16:08:24 unknown installd[4767] <Error>: 00381000 handle_install: API failed
Sep 17 16:08:24 unknown installd[4767] <Error>: 00381000 send_message: failed to send mach message of 71 bytes: 10000003
Sep 17 16:08:24 unknown installd[4767] <Error>: 00381000 send_error: Could not send error response to client
codesign --verify doesn't return any errors, and I have double-checked that I'm using the correct Ad Hoc provisioning profile (codesign --display -vvvv confirms this).
However, as soon as I remove all the Default.png images from the application, the install works and the application can be run afterwards. The IPA has a size of about 10 MB without and 15 MB with all Default.png images.
Any ideas?
Have you tried installing the IPA direct to your device via Xcode?
Connect device.
Open Xcode Organizer / Devices Tab / Select your device / Applications.
Click the + (add) button at the bottom left, select your app.
If this install fails as well, I suspect there's something up with your Default.png image. If you are scripting image conversion, it's worth mentioning that I've had lots of issues in the past using the sips command-line utility creating png images that Apple doesn't like, so I've stopped using that. I now use ImageMagick instead and have not had any trouble since.
It appears that upgrading to Xcode 4.5.1 has fixed the issue...