ogb912/micromdm
1
0
Fork 0
mirror of https://github.com/micromdm/micromdm/ synced 2026-08-07 10:05:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

add options for signing a profile (#602)

Browse Source
This commit is contained in:
Victor Vrantchan
2019-07-13 21:38:58 -04:00
committed by GitHub
parent d6e4afe4d7
commit e54ae2d2fb
5 changed files with 164 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/user-guide/enrolling-devices.md
View File

@@ -41,7 +41,7 @@ curl -o enroll.mobileconfig https://mdm.acme.co/mdm/enroll
```
Next, use a text editor to modify the payload.
You can also [sign](https://github.com/micromdm/micromdm/wiki/Sign-the-enrollment-profile-with-Hancock) the profile.
You can also [sign](./mdmctl-signing-profiles.md) the profile.
Once modified and signed, you can replace the default.

33
docs/user-guide/mdmctl-signing-profiles.md Normal file
View File

@@ -0,0 +1,33 @@
# Overview
The MicroMDM server does not composite or sign profiles for you. Instead, it gives you the option of providing a profile which you have signed through an external process, before uploading it to the server.
To make signing easier, MicroMDM adds the option to sign the profile as part of the `mdmctl` tool.
First, you will need a private key and certificate. Any certificate will do, but to be verified on the device, you should choose one that is trusted on the devices where you're sending the payloads. The `Developer ID` certificates from Apple are examples of trusted certificates.
# Signing with mdmctl
The `mdmctl apply profiles` command is used to upload a new configuration profile to the server. It can also be used to sign a profile.
First, run `mdmctl apply profiles -help` to see all the available command line flags.
Example command to sign a profile before uploading it to the server:
```
mdmctl apply profiles \
-f /path/to/profile.mobileconfig \
-private-key /path/to/key.pem \
-cert /path/to/certificate.pem \
-password=private_key_password \
-sign
```
You can also specify the `-out /path/to/signed_output.mobileconfig` to save the signed output locally, instead of uploading it to the server.
Using `-out -` will print the signed contents to the standard output, allowing you to pipe the output to another operation.
# Signing with other tools
You can use the `security` command on the Mac to sign configuration profiles with a certificate stored in the Keychain.
Example:
```
usr/bin/security cms -S -N 'Your KeyChain Cert' -i profile.mobileconfig -o signed.mobileconfig
```
Another popular choice is Jeremy Agostino's [Hancock](https://github.com/JeremyAgost/Hancock), a GUI utility for signing profiles and packages.