> ## Content Index > Fetch the complete content index at: https://developerinsider.co/llms.txt > Use this file to discover other available public pages before exploring further. # How to create a verified iOS Mobile Device Management(MDM) profile? - URL: https://developerinsider.co/how-to-create-a-verified-ios-mobile-device-management-mdm-profile/ - Published: 2018-03-30T10:07:15.000Z - Updated: 2020-10-26T03:55:06.000Z - Author: Vineet Choudhary - Tags: iOS, MDM The Mobile Device Management (MDM) protocol provides a way for system administrators to send device management commands to managed iOS devices running iOS 4 and later, macOS devices running macOS v10.7 and later, and Apple TV devices running iOS 7 (Apple TV software 6.0) and later. MDM allows for OS level control of multiple devices from a centralized location. A remote administrator can install/remove apps, install/revoke certificates, lock the device, change password requirements, etc. You can read more about Mobile Device Management [here](https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/1-Introduction/Introduction.html?ref=developerinsider.co). --- ~~**Warning**~~ \- ~~If you are planning to implement MDM protocol for your production application which you want to distribute via AppStore then I'm sorry to tell you, you can't do this. Because since November 2018, using MDM/VPN for ad blocking or screen-time monitoring is not considered compliant with the App Store Review Guidelines. Read more about this [here](https://developerinsider.co/appstore-guideline-2-5-1-your-app-uses-public-apis-in-an-unapproved-manner/)~~. **Update (28 Apr 2019)** \- Apple release [press update](https://www.apple.com/newsroom/2019/04/the-facts-about-parental-control-apps/?ref=developerinsider.co) about the Parental Control Apps. **Update (09 July 2019)** \- Apple restores banned from apps which are using MDM to the App Store. --- ## 1\. Create MDM Vendor CSR - Open Keychain Access. - Go to the menu bar: Keychain Access -> Certificate Assistant -> Request a Certificate From a Certificate Authority. - Use the same email as the developer account that will be used. Enter in a common name as well. - Select Saved to disk. ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/MDMVendorCSR.png?raw=true) **Note** \- Save all file in same directory (let's say MDM). ## 2\. Upload CSR to Apple - Go to [Apple's Certificates, Identifiers & Profiles page](https://developer.apple.com/account/ios/certificate/create?ref=developerinsider.co). - Select MDM CSR under Production. If this option is disabled, you will need to contact apple to enable it. You can either email apple at or go through the online contact menu. In your message, indicate that you are looking to create an MDM Vendor Certificate and need the MDM CSR option enabled on the certificate creation page. Apple should respond within one business day according to their contact page. ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/MDMCSR2.png?raw=true) - When you have the MDM CSR option available, select it and hit continue. Hit continue again through Apple's description of how to create a CSR file (we already have one). ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/MDMCSR3.png?raw=true) - Upload the .certSigningRequest file we created in step 1 and then hit generate. - A .cer file should be downloaded. Name it something like `mdmvendor.cer`. - You can also download .cer file later from Certificates section. ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/MDMCSR4.png?raw=true) ## 3\. Export MDM private key - Open your `mdmvendor.cer` file in Keychain Access. - Select Certificates from the left side. - You should find your certificate listed as MDM Vendor: Common Name. - There should be an arrow on that line that opens up show the MDM private key. - Right-click the private key, select Export..., and save as `private.p12` ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/MDMVendorPrivateKey.png?raw=true) - Remember where you save this file, we will use it in step 5. ## 4\. Create Push Certificate CSR - In Keychain Access, again select from the menu bar: Keychain Access -> Certificate Assistant -> Request a Certificate From a Certificate Authority. - Enter your email (can be a different email) and a common name. - Select Saved to disk and name it `push.csr`. (Same as Step 1) ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/MDMVendorCSR.png?raw=true) ## 5\. Extract MDM private key and MDM Vendor Certificate Open terminal and change the directory to the MDM directory, which you created in Step 1\. Also, make sure at this stage MDM directory must contains following 4 files - ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/BeforeStep5Files.png?raw=true) - **Extract private key using the following command:** If you've added any password in `private.p12` file during export in step 3 you need to enter same import password in this command. Also you need to enter PEM pass phrase. This pass phrase will be requires in next command. ```bash openssl pkcs12 -in private.p12 -nocerts -out key.pem ``` - **Strip the password from the private key using the following command:** This command ask you to enter pass phrase for `key.pem`, here you need to enter same pass phrase which you entered in last command. ```bash openssl rsa -in key.pem -out private.key ``` - **Extract certificate using the following command:** Again, if you've added any password in `private.p12` file during export in step 3 you need to enter same import password in this command. ```bash openssl pkcs12 -in private.p12 -clcerts -nokeys -out cert.pem ``` - **Convert certificate to DES using the following command:** ```bash openssl x509 -in cert.pem -inform PEM -out mdm.cer -outform DES ``` - In this step you've created 4 files `key.pem`, `private.key`, `cert.pem` and `mdm.cer`. These files will be used in the next step. After this step you MDM directory will look like this - ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/AfterStep5.png?raw=true) ## 6\. Use the mdmvendorsign tool to create applepush.csr - We're going to use the python code located in `/vendor/` of the [repository](https://github.com/vineetchoudhary/Apple-iOS-MDM-Server?ref=developerinsider.co). So, you need to clone this repository. To clone, run this command ```bash git clone https://github.com/vineetchoudhary/Apple-iOS-MDM-Server.git ``` - Now, copy `private.key`, `push.csr`, and `mdm.cer` into `Apple-iOS-MDM-Server/vendor/`. You can run these command to copy - ```bash cp push.csr ./Apple-iOS-MDM-Server/vendor/ cp private.key ./Apple-iOS-MDM-Server/vendor cp mdm.cer ./Apple-iOS-MDM-Server/vendor/ # Change directory cd Apple-iOS-MDM-Server/vendor/ ``` - Run the following command while in that directory: ```bash python mdm_vendor_sign.py --key private.key --csr push.csr --mdm mdm.cer --out applepush.csr ``` This should generate `applepush.csr`. ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/Step6Commands.png?raw=true) ## 7\. Get Push Certificate from Apple - Go to [Apple's Push Certificates Portal](https://identity.apple.com/pushcert/?ref=developerinsider.co) and click the Create a Certificate button. ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/NewPushCertificate.png?raw=true) - Upload `applepush.csr` to create a new entry in the table. - Download the resulting push certificate. ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/CertificateList.png?raw=true) - Open the push certificate in Keychain Access. ## 8\. Prepare Push Certificate - Find the push certificate in Keychain Access. It should look like `APSP:hexstuffhere`. - Right-click the certificate and select Get Info. - Copy down the User ID which should look like `com.apple.mgmt.External.hexstuffhere...`. We will use it later ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/MDMUserId.png?raw=true) - Right-click the certificate and select Export... and save it as `mdm.p12` ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/MDMExport.png?raw=true) - Run the following command to convert it to a pem file. Again, if you've added any password in `mdm.p12` file during export you need to enter same import password in this command. ```bash openssl pkcs12 -in mdm.p12 -out PushCert.pem -nodes ``` - Copy the resulting `PushCert.pem` file to `/server/`. You can use this command to copy - ```bash cp PushCert.pem ./Apple-iOS-MDM-Server/scripts/ ``` ## 9\. Generate additional certs - Go to the `scripts` directory and rename the different part of your domain SSL certificate as following - - Rename your Certificate Authority (CA) certificate to `cacert.crt`, `identity.crt` and `server.crt` (Same file with three different names). Your CA cetificate content looks like this - ```txt -----BEGIN CERTIFICATE----- MIIFPDCCBCSgAwIBAgIJALJxXxDRdGWNMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYD VQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEa MBgGA1UEChMRR29EYWRkeS5jb20sIE................................. .............................pyoNqhOasNUfoAbPgmXt+zXiy9AZWOds6Dc PtRTSsEEfATviu+nd7jrjS6AW/g4UKBorujxHYtGoqVfNx6aCqHMS+gmH0JbSnX9 -----END CERTIFICATE----- ``` - Rename your server Certificate Signing Request (CSR) file to `identity.csr`. The content of CSR file looks like this - ```txt -----BEGIN CERTIFICATE REQUEST----- MIIDAzCCAesCAQAwgaIxCzAJBgNVBAYTAkFVMRgwFgYDVQQIDA9Tb3V0aCBBdXN0 cmFsaWExETAPBgNVBAcMC........................................... ...........................mqeUCKtYnoCE/zkUUPErkHq4dWo3f+JGPC4Dt Onj3dUOtkKJifHw0iknYl+fIMnoYfRsVKQ9d3GVKGqb/A4s4qFzbQWbU1rNq9Sx9 mZgrKORxjA== -----END CERTIFICATE REQUEST----- ``` - Rename your server SSL certificate private key to `cakey.key`, `server.key` and `identity.key` (Same file with three different names). The content of CSR file looks like this - ```txt -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQD2Xh1z9I4rWZ9J t5EyoJtH2ImS7UQo5bABItKkYFjP50towTD4+k2PfgPZCRJ3kDSlOVSLHzfD57qB kCv/UG29nbbIkFH6aqjhfaj......................................... .................................j8yc3sduzKMd+KoZGGLzEhB/JEFTrHn jWwvMQENHRawj/Jocsc0PUA= -----END PRIVATE KEY----- ``` - Now, run `make_certs.sh`. You need to create an export password. You'll need to include it in the MDM profile. ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/Step9Command.png?raw=true) - This will generate a number of necessary certificates to move forward. - All certificates will be automatically moved to their proper location in `/server`. We'll use `identity.p12` in step 10 to create an `Enroll.mobileconfig` file. ## 10\. Create Enroll.mobileconfig - Open the [Apple Configurator 2](https://itunes.apple.com/in/app/apple-configurator-2/id1037126344?mt=12&ref=developerinsider.co), click File option in menu bar, and then click the New Profile. - In the General category, pick a name to identify the cert. For Identifier, use the `com.apple.mgmt.External.hexstuffhere` that you copied down in step 8. ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/AC2General.png?raw=true) - In the Certificates category, click configure and find your `scripts/identity.p12` file generated in step 9\. For password, we either use the PEM password or the export password. Also, add the `server.crt`, `Apple Root CA`, `Apple Worldwide Developer Relations CA - G2` and `Apple Worldwide Developer Relations Certification Authority` certificates. You can download these certificates from [Apple website.](https://www.apple.com/certificateauthority/?ref=developerinsider.co) So, here you need to add total 5 certificates. ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/AC2Cert.png?raw=true) - Now, save this mobile configuration as `Enroll.mobileconfig`. ## 11\. Config Mobile Device Management - For Mobile Device Management, Open `Enroll.mobileconfig` file in any text editor. Your `Enroll.mobileconfig` file looks like this - ```xml ConsentText default Install "Developer Insider" to enable you device monitoring. PayloadContent PayloadCertificateFileName server.crt PayloadContent LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZQRENDQkNT Z0F3SUJBZ0lKQUxKeFh4R............................... .....................ElNNUN1ZgpSZVlObnlpY3Nia3FXbGV0 TncrdkhYL2J2Wjg9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K PayloadDescription Adds a PKCS#1-formatted certificate PayloadDisplayName *.example.com PayloadIdentifier com.apple.security.pkcs1.4AA9D1AB-XXXX-XXXX-XXX-1E9280222697 PayloadType com.apple.security.pkcs1 PayloadUUID 4AA9D1AB-XXXX-XXXX-XXXX-1E9280222697 PayloadVersion 1 PayloadCertificateFileName AppleIncRootCertificate.cer PayloadContent MIIEuzCCA6OgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBiMQswCQYD VQQGEwJVUzETMBEGA1U................................. ................xw8dtk2cXmPIS4AXUKqK1drk/NAJBzewdXUh PayloadDescription Adds a CA root certificate PayloadDisplayName Apple Root CA PayloadIdentifier com.apple.security.root.57B909F1-XXXX-XXXX-XXXX-B066B59CA281 PayloadType com.apple.security.root PayloadUUID 57B909F1-XXXX-XXXX-XXXX-B066B59CA281 PayloadVersion 1 PayloadCertificateFileName AppleWWDRCAG2.cer PayloadContent MIIC9zCCAnygAwIBAgIIb+/Y9emjp+4wCgYIKoZIzj0EAwIwZzEb MBkGA1UEAwwSQXBwbGUgUm9v............................ ....................FUOixRLal1BzfF7QbrJcYlDXUfE6Wg== PayloadDescription Adds a PKCS#1-formatted certificate PayloadDisplayName Apple Worldwide Developer Relations CA - G2 PayloadIdentifier com.apple.security.pkcs1.685F84A4-XXXX-XXXX-XXXX-4EBD1021F707 PayloadType com.apple.security.pkcs1 PayloadUUID 685F84A4-XXXX-XXXX-XXXX-4EBD1021F707 PayloadVersion 1 PayloadCertificateFileName AppleWWDRCA.cer PayloadContent MIIEIjCCAwqgAwIBAgIIAd68xDltoBAwDQYJKoZIhvcNAQEFBQAw YjELMAkGA1UEBhMCVVMxEzA............................. ................05Cdqa3zr/04GpZnMBxRpVzscYqCtGwPDBUf PayloadDescription Adds a PKCS#1-formatted certificate PayloadDisplayName Apple Worldwide Developer Relations Certification Authority PayloadIdentifier com.apple.security.pkcs1.1BD58990-XXXX-XXXX-XXXX-7D09252A9190 PayloadType com.apple.security.pkcs1 PayloadUUID 1BD58990-XXXX-XXXX-XXXX-7D09252A9190 PayloadVersion 1 Password test@123 PayloadCertificateFileName identity.p12 PayloadContent MIIeyQIBAzCCHo8GCSqGSIb3DQEHAaCCHoAEgh58MIIeeDCCGS8G CSqGSIb3DQEHBqCCGSAwghk............................. ....................DAyJB5BmDPMECJpm+FuDUe5tAgIIAA== PayloadDescription Adds a PKCS#12-formatted certificate PayloadDisplayName identity.p12 PayloadIdentifier com.apple.security.pkcs12.38236F74-XXXX-XXXX-XXXX-5C4923A303FA PayloadType com.apple.security.pkcs12 PayloadUUID 38236F74-XXXX-XXXX-XXXX-5C4923A303FA PayloadVersion 1 PayloadDescription "Developer Insider Device Certificate" enable Developer Insider server to control your device. PayloadDisplayName Developer Insider Device Certificate PayloadIdentifier com.apple.mgmt.External.63cccfb4-XXXX-XXXX-XXXX-82bcc05a2535 PayloadOrganization Developer Insider PayloadRemovalDisallowed PayloadType Configuration PayloadUUID 0CF6836A-XXXX-XXXX-XXXX-12B61C878FB4 PayloadVersion 1 ``` - Now we need to add following MDM options dictionary into `PayloadContent` array of `Enroll.mobileconfig`. ```xml AccessRights 4096 CheckInURL https://YOUR_HOSTNAME_OR_IP:8080/checkin CheckOutWhenRemoved IdentityCertificateUUID 38236F74-XXXX-XXXX-XXXX-5C4923A303FA PayloadDescription Configures MobileDeviceManagement. PayloadIdentifier com.apple.mdm.34995C2E-XXXX-XXXX-XXXX-D6DB637A1D6E PayloadOrganization Developer Insider PayloadType com.apple.mdm PayloadUUID 34995C2E-XXXX-XXXX-XXXX-D6DB637A1D6E PayloadVersion 1 ServerURL https://YOUR_HOSTNAME_OR_IP:8080/server SignMessage Topic com.apple.mgmt.External.63cccfb4-XXXX-XXXX-XXXX-82bcc05a2535 UseDevelopmentAPNS ``` **Structure of MDM Payloads** The Mobile Device Management (MDM) payload, a simple property list, is designated by the `com.apple.mdm` value in the `PayloadType` field. This payload defines the following keys specific to MDM payloads: Key Type Description IdentityCertificateUUID String *Mandatory.* UUID of the certificate payload for the device’s identity. It may also point to a SCEP payload. You need to use the \`PayloadUUID\` of the \`identity.p12\` in this field. IdentityCertificateUUID String *Mandatory.* Here you need to generate a UUID. You can use \`uuidgen\` to generate an UUID and then copy paste that UUID in this field. UUID looks like this 34995C2E-XXXX-XXXX-XXXX-D6DB637A1D6E PayloadIdentifier String Here you need to append the UUID in after \`com.apple.mdm.\` which we generated in last step. Your payload identifier looks like this com.apple.mdm.34995C2E-XXXX-XXXX-XXXX-D6DB637A1D6E Topic String *Mandatory.* The topic that MDM listens to for push notifications. The certificate that the server uses to send push notifications must have the same topic in its subject. The topic must begin with the `com.apple.mgmt.External.hexstuffhere...` prefix. ServerURL String *Mandatory.* The URL that the device contacts to retrieve device management instructions. Must begin with the `https://` URL scheme, and may contain a port number (`https://YOUR_HOSTNAME_OR_IP:PORT/server`, for example). CheckInURL String *Optional.* The URL that the device should use to check in during installation. Must begin with the `https://` URL scheme and may contain a port number (`https://YOUR_HOSTNAME_OR_IP:8080/checkin`, for example). If this URL is not given, the `ServerURL` is used for both purposes. CheckOutWhenRemoved Boolean *Optional.* If `true`, the device attempts to send a `CheckOut` message to the check-in server when the profile is removed. Defaults to `false`. AccessRights Integer, flags *Required.* Logical OR of the following bit-flags: - 1: Allow inspection of installed configuration profiles. - 2: Allow installation and removal of configuration profiles. - 4: Allow device lock and passcode removal. - 8: Allow device erase. - 16: Allow query of Device Information (device capacity, serial number). - 32: Allow query of Network Information (phone/SIM numbers, MAC addresses). - 64: Allow inspection of installed provisioning profiles. - 128: Allow installation and removal of provisioning profiles. - 256: Allow inspection of installed applications. - 512: Allow restriction-related queries. - 1024: Allow security-related queries. - 2048: Allow manipulation of settings. - 4096: Allow app management. May not be zero. If 2 is specified, 1 must also be specified. If 128 is specified, 64 must also be specified. UseDevelopmentAPNS Boolean *Optional.* If `true`, the device uses the development APNS servers. Otherwise, the device uses the production servers. Defaults to `false`. Note that this property must be set to false if your Apple Push Notification Service certificate was issued by the [Apple Push Certificate Portal](https://identity.apple.com/pushcert?ref=developerinsider.co). That portal only issues certificates for the production push environment. - Now save the file as `Enroll.mobileconfig` and move it to the `/server` directory. - Your final `Enroll.movbileconfig` will be looks like this - ```xml ConsentText default Install "Developer Insider" to enable you device monitoring. PayloadContent PayloadCertificateFileName server.crt PayloadContent LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZQRENDQkNT Z0F3SUJBZ0lKQUxKeFh4R............................... .....................ElNNUN1ZgpSZVlObnlpY3Nia3FXbGV0 TncrdkhYL2J2Wjg9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K PayloadDescription Adds a PKCS#1-formatted certificate PayloadDisplayName *.example.com PayloadIdentifier com.apple.security.pkcs1.4AA9D1AB-XXXX-XXXX-XXX-1E9280222697 PayloadType com.apple.security.pkcs1 PayloadUUID 4AA9D1AB-XXXX-XXXX-XXXX-1E9280222697 PayloadVersion 1 PayloadCertificateFileName AppleIncRootCertificate.cer PayloadContent MIIEuzCCA6OgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBiMQswCQYD VQQGEwJVUzETMBEGA1U................................. ................xw8dtk2cXmPIS4AXUKqK1drk/NAJBzewdXUh PayloadDescription Adds a CA root certificate PayloadDisplayName Apple Root CA PayloadIdentifier com.apple.security.root.57B909F1-XXXX-XXXX-XXXX-B066B59CA281 PayloadType com.apple.security.root PayloadUUID 57B909F1-XXXX-XXXX-XXXX-B066B59CA281 PayloadVersion 1 PayloadCertificateFileName AppleWWDRCAG2.cer PayloadContent MIIC9zCCAnygAwIBAgIIb+/Y9emjp+4wCgYIKoZIzj0EAwIwZzEb MBkGA1UEAwwSQXBwbGUgUm9v............................ ....................FUOixRLal1BzfF7QbrJcYlDXUfE6Wg== PayloadDescription Adds a PKCS#1-formatted certificate PayloadDisplayName Apple Worldwide Developer Relations CA - G2 PayloadIdentifier com.apple.security.pkcs1.685F84A4-XXXX-XXXX-XXXX-4EBD1021F707 PayloadType com.apple.security.pkcs1 PayloadUUID 685F84A4-XXXX-XXXX-XXXX-4EBD1021F707 PayloadVersion 1 PayloadCertificateFileName AppleWWDRCA.cer PayloadContent MIIEIjCCAwqgAwIBAgIIAd68xDltoBAwDQYJKoZIhvcNAQEFBQAw YjELMAkGA1UEBhMCVVMxEzA............................. ................05Cdqa3zr/04GpZnMBxRpVzscYqCtGwPDBUf PayloadDescription Adds a PKCS#1-formatted certificate PayloadDisplayName Apple Worldwide Developer Relations Certification Authority PayloadIdentifier com.apple.security.pkcs1.1BD58990-XXXX-XXXX-XXXX-7D09252A9190 PayloadType com.apple.security.pkcs1 PayloadUUID 1BD58990-XXXX-XXXX-XXXX-7D09252A9190 PayloadVersion 1 Password test@123 PayloadCertificateFileName identity.p12 PayloadContent MIIeyQIBAzCCHo8GCSqGSIb3DQEHAaCCHoAEgh58MIIeeDCCGS8G CSqGSIb3DQEHBqCCGSAwghk............................. ....................DAyJB5BmDPMECJpm+FuDUe5tAgIIAA== PayloadDescription Adds a PKCS#12-formatted certificate PayloadDisplayName identity.p12 PayloadIdentifier com.apple.security.pkcs12.38236F74-XXXX-XXXX-XXXX-5C4923A303FA PayloadType com.apple.security.pkcs12 PayloadUUID 38236F74-XXXX-XXXX-XXXX-5C4923A303FA PayloadVersion 1 AccessRights 4096 CheckInURL https://YOUR_HOSTNAME_OR_IP:8080/checkin/ CheckOutWhenRemoved IdentityCertificateUUID 38236F74-XXXX-XXXX-XXXX-5C4923A303FA PayloadDescription Configures MobileDeviceManagement. PayloadIdentifier com.apple.mdm.34995C2E-XXXX-XXXX-XXXX-D6DB637A1D6E PayloadOrganization Developer Insider PayloadType com.apple.mdm PayloadUUID 34995C2E-XXXX-XXXX-XXXX-D6DB637A1D6E PayloadVersion 1 ServerURL https://YOUR_HOSTNAME_OR_IP:8080/server/ SignMessage Topic com.apple.mgmt.External.63cccfb4-XXXX-XXXX-XXXX-82bcc05a2535 UseDevelopmentAPNS PayloadDescription "Developer Insider Device Certificate" enable Developer Insider server to control your device. PayloadDisplayName Developer Insider Device Certificate PayloadIdentifier com.apple.mgmt.External.63cccfb4-XXXX-XXXX-XXXX-82bcc05a2535 PayloadOrganization Developer Insider PayloadRemovalDisallowed PayloadType Configuration PayloadUUID 0CF6836A-XXXX-XXXX-XXXX-12B61C878FB4 PayloadVersion 1 ``` ## 12\. Signing / Verify Enroll.mobileconfig Profile If you try to use current `Enroll.mobileconfig` using Apple Configurator 2, you've probably noticed that it says ‘Unsigned’ when you send the .mobileconfig file to your device. ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/UnSignedProfile.png?raw=true) In order to sign `Enroll.mobileconfi` you need to save you server (domain SSL) certificate chain in the `server` directory with name `serverchain.pem`. `server.crt` and `server.pem` these two files you've already copy in step 9\. Now run this command in `server` directory to generate Signed mobile config profile with name `EnrollSigned.mobileconfig`. ```bash openssl smime -sign -signer server.crt -inkey server.pem -certfile serverchain.pem -nodetach -outform der -in Enroll.mobileconfig -out EnrollSigned.mobileconfig ``` ![](https://github.com/developerinsider/developer-insider-content/blob/master/POST/iOS/MDM/SignedProfile.png?raw=true) ## 13\. Cleanup - Any additional files that are not in `/server/` generated during this process are not necessary for running the server. Some of them may have/be private keys or other unique information, so it is probably a good idea to protect or destroy those files. - Most certs will be located in the `/scripts/` folder. There may be some certificates are part of your domain SSL certificate, so a good idea is save them elsewhere. - Please secure these files and prevent others from being able to access them. ## References - [Download Configuration Profile Reference PDF](https://github.com/developerinsider/developer-insider-content/blob/master/Files/pdf/MDM-Reference.pdf?raw=true&ref=developerinsider.co) - [Mobile Device Management Protocol Reference](https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/1-Introduction/Introduction.html?ref=developerinsider.co) - [Sample iOS MDM server | Github](https://github.com/project-imas/mdm-server?ref=developerinsider.co)