From 72487f8c1ef8afbf6403100cc602050affb84a5d Mon Sep 17 00:00:00 2001
From: Jesse Peterson <jessepeterson@users.noreply.github.com>
Date: Thu, 23 Aug 2018 07:20:47 -0700
Subject: [PATCH] Remove SCEP CA certificate from both being stored on disk and
 being included in the enrollment profile (#490)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SCEP CA certificate is not needed to establish trust between the client and MDM server. Thus including it in the enrollment profile is unnecessary. Separately, and since we don't need it, we can clean up the enrollment service a little by not reading the certificate from disk. Finally — just don't write it out to disk at all. Its usefulness on disk (for the sake of being in its own file) is debatable.
---
 mdm/enroll/service.go | 24 ++----------------------
 server/server.go      | 15 +--------------
 2 files changed, 3 insertions(+), 36 deletions(-)

diff --git a/mdm/enroll/service.go b/mdm/enroll/service.go
index 920fd221..01051c6c 100644
--- a/mdm/enroll/service.go
+++ b/mdm/enroll/service.go
@@ -29,18 +29,10 @@ type Service interface {
 	OTAPhase3(ctx context.Context) (profile.Mobileconfig, error)
 }
 
-func NewService(topic TopicProvider, sub pubsub.Subscriber, caCertPath, scepURL, scepChallenge, url, tlsCertPath, scepSubject string, profileDB profile.Store) (Service, error) {
-	var caCert, tlsCert []byte
+func NewService(topic TopicProvider, sub pubsub.Subscriber, scepURL, scepChallenge, url, tlsCertPath, scepSubject string, profileDB profile.Store) (Service, error) {
+	var tlsCert []byte
 	var err error
 
-	if caCertPath != "" {
-		caCert, err = ioutil.ReadFile(caCertPath)
-
-		if err != nil {
-			return nil, err
-		}
-	}
-
 	if tlsCertPath != "" {
 		tlsCert, err = ioutil.ReadFile(tlsCertPath)
 
@@ -72,7 +64,6 @@ func NewService(topic TopicProvider, sub pubsub.Subscriber, caCertPath, scepURL,
 		SCEPURL:       scepURL,
 		SCEPSubject:   subject,
 		SCEPChallenge: scepChallenge,
-		CACert:        caCert,
 		TLSCert:       tlsCert,
 		ProfileDB:     profileDB,
 		Topic:         pushTopic,
@@ -118,7 +109,6 @@ type service struct {
 	SCEPURL       string
 	SCEPChallenge string
 	SCEPSubject   [][][]string
-	CACert        []byte
 	TLSCert       []byte
 	ProfileDB     profile.Store
 
@@ -232,16 +222,6 @@ func (svc *service) MakeEnrollmentProfile() (Profile, error) {
 
 	payloadContent = append(payloadContent, mdmPayloadContent)
 
-	if len(svc.CACert) > 0 {
-		caPayload := NewPayload("com.apple.security.root")
-		caPayload.PayloadDisplayName = "Root certificate for MicroMDM"
-		caPayload.PayloadDescription = "Installs the root CA certificate for MicroMDM"
-		caPayload.PayloadIdentifier = EnrollmentProfileId + ".cert.ca"
-		caPayload.PayloadContent = svc.CACert
-
-		payloadContent = append(payloadContent, *caPayload)
-	}
-
 	// Client needs to trust us at this point if we are using a self signed certificate.
 	if len(svc.TLSCert) > 0 {
 		tlsPayload := NewPayload("com.apple.security.pem")
diff --git a/server/server.go b/server/server.go
index b377cc4d..69441413 100644
--- a/server/server.go
+++ b/server/server.go
@@ -60,11 +60,6 @@ type Server struct {
 	CommandWebhookURL   string
 	DEPClient           dep.Client
 
-	// TODO: refactor enroll service and remove the need to reference
-	// this on-disk cert. but it might be useful to keep the PEM
-	// around for anyone who will need to export the CA.
-	SCEPCACertPath string
-
 	PushService     *push.Service // bufford push
 	APNSPushService apns.Service
 	CommandService  command.Service
@@ -335,7 +330,6 @@ func (c *Server) setupEnrollmentService() error {
 	c.EnrollService, err = enroll.NewService(
 		topicProvider,
 		c.PubClient,
-		c.SCEPCACertPath,
 		c.ServerPublicURL+"/scep",
 		c.SCEPChallenge,
 		c.ServerPublicURL,
@@ -432,14 +426,7 @@ func (c *Server) setupSCEP(logger log.Logger) error {
 		return err
 	}
 
-	caCert, err := depot.CreateOrLoadCA(key, 5, "MicroMDM", "US")
-	if err != nil {
-		return err
-	}
-
-	c.SCEPCACertPath = filepath.Join(c.ConfigPath, "SCEPCACert.pem")
-
-	err = crypto.WritePEMCertificateFile(caCert, c.SCEPCACertPath)
+	_, err = depot.CreateOrLoadCA(key, 5, "MicroMDM", "US")
 	if err != nil {
 		return err
 	}