From 49fa779d1cd2c986a8717169cf531aae93bc015a Mon Sep 17 00:00:00 2001
From: Mosen <mosen@users.noreply.github.com>
Date: Wed, 29 Jun 2016 16:29:19 +1000
Subject: [PATCH] Add cli flag `tls-ca-cert` and environment var
 MICROMDM_TLS_CA_CERT to specify a CA certificate which will be included in
 the enrollment profile. This is handy if you are using self signed
 certificates and you need to establish a CA trust.

---
 enroll/service.go | 30 +++++++++++++++++++++++-------
 main.go           |  3 ++-
 2 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/enroll/service.go b/enroll/service.go
index c21411e9..b1457bb7 100644
--- a/enroll/service.go
+++ b/enroll/service.go
@@ -1,15 +1,27 @@
 package enroll
 
+import "io/ioutil"
+
 type Service interface {
 	Enroll() (Profile, error)
 }
 
-func NewService(pushCertPath string, pushCertPass string) (Service, error) {
+func NewService(pushCertPath string, pushCertPass string, caCertPath string) (Service, error) {
 	pushTopic, err := GetPushTopicFromPKCS12(pushCertPath, pushCertPass)
 	if err != nil {
 		return nil, err
 	}
 
+	var caCert []byte
+
+	if caCertPath != "" {
+		caCert, err = ioutil.ReadFile(caCertPath)
+
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	scepSubject := [][][]string{
 		[][]string{
 			[]string{"O", "MicroMDM"},
@@ -22,7 +34,7 @@ func NewService(pushCertPath string, pushCertPass string) (Service, error) {
 		SCEPUrl:     "http://micromdm.local:2019/scep",
 		SCEPSubject: scepSubject,
 		Topic:       pushTopic,
-		CACert:      []byte{},
+		CACert:      caCert,
 	}, nil
 }
 
@@ -73,12 +85,16 @@ func (svc service) Enroll() (Profile, error) {
 		Topic: svc.Topic,
 	}
 
-	//caPayload := NewPayload("com.apple.ssl.certificate")
-	//caPayload.PayloadDisplayName = "Root certificate for MicroMDM"
-	//caPayload.PayloadDescription = "Installs the root CA certificate for MicroMDM"
-	//caPayload.PayloadContent = []byte{}
+	if len(svc.CACert) > 0 {
+		caPayload := NewPayload("com.apple.ssl.certificate")
+		caPayload.PayloadDisplayName = "Root certificate for MicroMDM"
+		caPayload.PayloadDescription = "Installs the root CA certificate for MicroMDM"
+		caPayload.PayloadContent = svc.CACert
 
-	profile.PayloadContent = []interface{}{*scepPayload, mdmPayloadContent}
+		profile.PayloadContent = []interface{}{*scepPayload, mdmPayloadContent, *caPayload}
+	} else {
+		profile.PayloadContent = []interface{}{*scepPayload, mdmPayloadContent}
+	}
 
 	return *profile, nil
 }
diff --git a/main.go b/main.go
index a9e59b02..92304985 100644
--- a/main.go
+++ b/main.go
@@ -43,6 +43,7 @@ func main() {
 		flTLS          = flag.Bool("tls", envBool("MICROMDM_USE_TLS"), "use https")
 		flTLSCert      = flag.String("tls-cert", envString("MICROMDM_TLS_CERT", ""), "path to TLS certificate")
 		flTLSKey       = flag.String("tls-key", envString("MICROMDM_TLS_KEY", ""), "path to TLS private key")
+		flTLSCACert    = flag.String("tls-ca-cert", envString("MICROMDM_TLS_CA_CERT", ""), "path to CA certificate")
 		flPGconn       = flag.String("postgres", envString("MICROMDM_POSTGRES_CONN_URL", ""), "postgres connection url")
 		flRedisconn    = flag.String("redis", envString("MICROMDM_REDIS_CONN_URL", ""), "redis connection url")
 		flVersion      = flag.Bool("version", false, "print version information")
@@ -188,7 +189,7 @@ func main() {
 	commandSvc := command.NewService(commandDB)
 	checkinSvc := checkin.NewService(deviceDB, mgmtSvc, commandSvc, enrollmentProfile)
 	connectSvc := connect.NewService(deviceDB, commandSvc)
-	enrollSvc, _ := enroll.NewService(*flPushCert, *flPushPass)
+	enrollSvc, _ := enroll.NewService(*flPushCert, *flPushPass, *flTLSCACert)
 
 	httpLogger := log.NewContext(logger).With("component", "http")
 	managementHandler := management.ServiceHandler(ctx, mgmtSvc, httpLogger)