ogb912/micromdm
1
0
Fork 0
mirror of https://github.com/micromdm/micromdm/ synced 2026-08-07 18:15:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

Remove SCEP CA certificate from both being stored on disk and being included in the enrollment profile (#490)

Browse Source 
The SCEP CA certificate is not needed to establish trust between the client and MDM server. Thus including it in the enrollment profile is unnecessary. Separately, and since we don't need it, we can clean up the enrollment service a little by not reading the certificate from disk. Finally — just don't write it out to disk at all. Its usefulness on disk (for the sake of being in its own file) is debatable.
This commit is contained in:
Jesse Peterson
2018-08-23 07:20:47 -07:00
committed by Scott Knight
parent 2f2616e274
commit 72487f8c1e
2 changed files with 3 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
mdm/enroll/service.go
View File

@@ -29,18 +29,10 @@ type Service interface {
OTAPhase3(ctx context.Context) (profile.Mobileconfig, error)
}
func NewService(topic TopicProvider, sub pubsub.Subscriber, caCertPath, scepURL, scepChallenge, url, tlsCertPath, scepSubject string, profileDB profile.Store) (Service, error) {
var caCert, tlsCert []byte
func NewService(topic TopicProvider, sub pubsub.Subscriber, scepURL, scepChallenge, url, tlsCertPath, scepSubject string, profileDB profile.Store) (Service, error) {
var tlsCert []byte
var err error
if caCertPath != "" {
caCert, err = ioutil.ReadFile(caCertPath)
if err != nil {
return nil, err
}
}
if tlsCertPath != "" {
tlsCert, err = ioutil.ReadFile(tlsCertPath)
@@ -72,7 +64,6 @@ func NewService(topic TopicProvider, sub pubsub.Subscriber, caCertPath, scepURL,
SCEPURL: scepURL,
SCEPSubject: subject,
SCEPChallenge: scepChallenge,
CACert: caCert,
TLSCert: tlsCert,
ProfileDB: profileDB,
Topic: pushTopic,
@@ -118,7 +109,6 @@ type service struct {
SCEPURL string
SCEPChallenge string
SCEPSubject [][][]string
CACert []byte
TLSCert []byte
ProfileDB profile.Store
@@ -232,16 +222,6 @@ func (svc *service) MakeEnrollmentProfile() (Profile, error) {
payloadContent = append(payloadContent, mdmPayloadContent)
if len(svc.CACert) > 0 {
caPayload := NewPayload("com.apple.security.root")
caPayload.PayloadDisplayName = "Root certificate for MicroMDM"
caPayload.PayloadDescription = "Installs the root CA certificate for MicroMDM"
caPayload.PayloadIdentifier = EnrollmentProfileId + ".cert.ca"
caPayload.PayloadContent = svc.CACert
payloadContent = append(payloadContent, *caPayload)
}
// Client needs to trust us at this point if we are using a self signed certificate.
if len(svc.TLSCert) > 0 {
tlsPayload := NewPayload("com.apple.security.pem")

15
server/server.go
View File

@@ -60,11 +60,6 @@ type Server struct {
CommandWebhookURL string
DEPClient dep.Client
// TODO: refactor enroll service and remove the need to reference
// this on-disk cert. but it might be useful to keep the PEM
// around for anyone who will need to export the CA.
SCEPCACertPath string
PushService *push.Service // bufford push
APNSPushService apns.Service
CommandService command.Service
@@ -335,7 +330,6 @@ func (c *Server) setupEnrollmentService() error {
c.EnrollService, err = enroll.NewService(
topicProvider,
c.PubClient,
c.SCEPCACertPath,
c.ServerPublicURL+"/scep",
c.SCEPChallenge,
c.ServerPublicURL,
@@ -432,14 +426,7 @@ func (c *Server) setupSCEP(logger log.Logger) error {
return err
}
caCert, err := depot.CreateOrLoadCA(key, 5, "MicroMDM", "US")
if err != nil {
return err
}
c.SCEPCACertPath = filepath.Join(c.ConfigPath, "SCEPCACert.pem")
err = crypto.WritePEMCertificateFile(caCert, c.SCEPCACertPath)
_, err = depot.CreateOrLoadCA(key, 5, "MicroMDM", "US")
if err != nil {
return err
}