MDM iPCU Profile Installation Failed in iOS SDK - ios

Question

I am doing a MDM vendor set up and having apple enterprise account for the same.But after completing all the steps I am getting an issue when I try to install the iPhone Configuration Utility file on the iPhone.We are getting an alert saying “Profile Installation Failed”.Please suggest what you suspect may be wrong.Following are the steps I followed for my profile creation.
For Vendor:
I created my vendor csr on my macbook called vendor.csr.
Email: My Enterprise Account Email.
Common Name: My Company Name.
Saved to Disk.
Uploaded the vendor.csr file to the enterprise account and downloaded the mdm.cer file from the account.
Loaded this certificate to the key chain.
Exported the .p12 file as private.p12 file.
Extracted Private key using command : openssl pkcs12 -in private.p12 -nocerts -out key.pem
Extracted Certificate : openssl pkcs12 -in private.p12 -clcerts -nokeys -out cert.pem
Convert the certificate to des form : openssl x509 -in cert.pem -inform PEM -out mdm.cer -outform DES
8.Stripped password from private key : openssl rsa -in key.pem -out private.key
For customer:
Now I created one more csr for push from the same macbook called push.csr.
Email: Company Support Email.
Common Name : Company Name Push
Saved to Disk.
Python Code :
Link: https://github.com/grinich/mdmvendorsign
I got the python code from the above link to get the plist encoded file from the files I generated above i.e. private.key, push.csr, mdm.cer.I renamed my files according to the command below and generated a plist encoded file.
Command : python mdm_vendor_sign.py --csr user_submitted_CSR.csr --key mdm_vendor_private.key --mdm mdm_certifiate_from_apple.cer
Push Cert :
Then I uploaded a plist encoded file on “https://identity.apple.com/pushcert/” and downloaded the resulting push certificate from there.
Installed the pushcert downloaded to the key chain and exported it in the p12 format and call it mdm.p12.
Converted the mdm.p12 to PEM format : openssl pkcs12 -in mdm.12 -out pushcert.pem -nodes
iPhone Configuration Utility :
I implemented three sections of iPCU. For server setup I am using RapidSSL for my server set up.
General
a. Name : My Company Private Limited
b. Identifier: com.mycompany.mdm.profile
c. Organization : My Company Name
d. Description : Version 1.0
e. Security : Always.
Credentials
Uploaded the pushcert.pem file generated at the last step of push cert work.
Mobile Device Management
a. Server URL : https://xyz.server
b Check In URL : https://xyz.checin
c. Topic :com.apple.mgmt.External.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
d. Identity : selected from credential.
Export iPCU -> None/SignConfigurationProfile (tried both).
Now this file is failing to install on the device when I send it through mail and I am getting message profile installation failed.What I understand from logs that the device is unable to make connection to the server.please suggest me how could I resolve that.
Device Logs:
Nov 27 19:02:21 iPhone profiled[114] <Notice>: (Note ) MC: Checking for MDM installation...
Nov 27 19:02:21 iPhone profiled[114] <Notice>: (Note ) MC: ...finished checking for MDM installation.
Nov 27 19:02:21 iPhone profiled[114] <Notice>: (Note ) MC: Beginning profile installation...
Nov 27 19:02:21 iPhone profiled[114] <Error>: SecTrustEvaluate [leaf AnchorTrusted]
Nov 27 19:02:23 iPhone locationd[63] <Notice>: Gesture EnabledForTopCLient: 0, EnabledInDaemonSettings: 0
Nov 27 19:02:24 iPhone locationd[63] <Notice>: Gesture EnabledForTopCLient: 0, EnabledInDaemonSettings: 0
Nov 27 19:02:24 iPhone profiled[114] <Error>: SecTrustEvaluate [leaf AnchorTrusted]
Nov 27 19:02:26 iPhone profiled[114] <Notice>: (Error) MDM: Cannot Authenticate. Error: NSError:
Desc : A connection to the server could not be established.
US Desc: A connection to the server could not be established.
Domain : MCHTTPTransactionErrorDomain
Code : 23001
Type : MCFatalError
Params : (
"https://mdm.myCompanyName.com/Service1.svc",
500
)
Nov 27 19:02:26 iPhone profiled[114] <Notice>: (Error) MC: Cannot install MDM “Mobile Device Management”. Error: NSError:
Desc : The payload “Mobile Device Management” could not be installed.
Sugg : A connection to the server could not be established.
US Desc: The payload “Mobile Device Management” could not be installed.
US Sugg: A connection to the server could not be established.
Domain : MCInstallationErrorDomain
Code : 4001
Type : MCFatalError
Params : (
"Mobile Device Management"
)
...Underlying error:
NSError:
Desc : A connection to the server could not be established.
US Desc: A connection to the server could not be established.
Domain : MCHTTPTransactionErrorDomain
Code : 23001
Type : MCFatalError
Params : (
"https://mdm.myCompanyName.com/Service1.svc",
500
)
Nov 27 19:02:26 iPhone profiled[114] <Notice>: (Error) MC: Rolling back installation of profile “com.myCompanyName.mdm.profile”...
Nov 27 19:02:26 iPhone profiled[114] <Notice>: (Error) MC: Installation of profile “com.myCompanyName.mdm.profile” failed with error: NSError:
Desc : The profile “myCompanyName” could not be installed.
Sugg : The payload “Mobile Device Management” could not be installed.
US Desc: The profile “myCompanyName” could not be installed.
US Sugg: The payload “Mobile Device Management” could not be installed.
Domain : MCProfileErrorDomain
Code : 1009
Type : MCFatalError
Params : (
"myCompanyName"
)

Answer 1

The certificate you generated with your MDM vendor cert from Apple isn't used for device authentication. It's used for that particular server to send notifications to APNs.
The identity in iPCU (Which was deprecated long ago) is for a client certificate. Also remember that all TLS certificates need to be valid and trusted. Your server is rejecting the client with a HTTP 500, so I would start investigating the server logs as to why.
Really though if you are developing your own MDM solution I would open a DTS incident with Apple. The API documents are only published to folks in the Enterprise Developer Program and not publicly available. Rather than here, the MDM section of the Apple Developer Forums is probably a better place to discuss it.