Generating an Apple Enterprise MDM Certificate

Transcription

1 Good Mobile Control Server Generating an Apple Enterprise MDM Certificate Updated 09/30/11 Overview... 1 Generating Your Apple Certificate Using a Mac... 1 Generating Your Apple Certificate Using Windows... 6 Overview The Good Mobile Control Server Mobile Device Management (MDM) features for ios require an Enterprise MDM Certificate which is purchased from Apple and uploaded to the Good Mobile Console software through the Settings > Certificates > Import command. Log into developer.apple.com as the Team Agent for your account in order to create your Apple certificate. You must be a member of the Apple ios Developer Enterprise Program. Refer to the relevant Apple online documentation for explanations. Note the following: Your Bundle Identifier must begin with com.apple.mgmt. Choose the.p12 file when you import the certificate into the Good Mobile Console. If you attempt to enable MDM without a certificate, you ll encounter an error message: MDM cannot be enabled when there are no MDM certificates. You can upload a certificate using the Settings > Certificate page. If you want to delete the certificate later, you must first uncheck the MDM feature within all policy sets where it has been selected. Generating Your Apple Certificate Using a Mac The following procedure assumes that you are working on a Mac and that you are going to create a new Enterprise MDM Certificate: 1. Log into developer.apple.com as the Team Agent for your account and open ios Provisioning Portal > Certificates > Distribution. 1

2 2. Start creating your Enterprise MDM Certificate by clicking the New App ID button on the right: 3. Enter a name for your App ID and enter a Bundle Identifier in the free-form text field. The bundle id must be com.apple.mgmt.[companyname] for mdm certificates. Click Submit when you are done. A 10-character Bundle Seed ID is generated and concatenated with your Bundle Identifier. This string is your App ID. Production push is not yet enabled, however. 4. Locate the App ID you just created in the App IDs page. Click the Configure link to the right of the listing to register this App ID and configure a certificate for it. 2

3 5. Select Enable for Apple Push Notification service under the Manage tab then click the Configure button for one of the Certificates. 6. Create a Certificate Signing Request (CSR) by following the prompts from the Apple Push Notification service SSL Certificate Assistant. 7. Note: Open the Keychain-Access utility on your development machine to start the process. 8. After you create the certificate on the development computer, the wizard asks for the certificate s location. Navigate to the directory which contains the CSR and click Generate: 3

4 The following screen confirms that you ve successfully generated a certificate: 9. After you finish creating the Client SSL certificate, click the Download button to download it: 4

5 10. Navigate to directory which contains the downloaded certificate and double-click the certificate file (which has an extension of cer) to install it in your keychain. 11. Export the certificate using the Personal Information Exchange (.p12) format. 5

6 12. Enter a password for export. You ll use this same password when uploading the cert to your GMC in the following step. 13. Import the.p12 file it into the Good Mobile Console software by using Settings > Certificates > Import. When you import, select the Personal Information Exchange (.p12) format. You can enter a Name and Description as free text, but the Password value must match the password you specified during.p12 export. Generating Your Apple Certificate Using Windows The following procedure assumes that you are working on a Windows server and that you are creating a MDM Enterprise Certificate. 1. Begin by generating a certificate signing request (CSR). To do so, open Start > Administrative Tools > Internet Information Services (IIS) on any Windows server. You ll need Administrator permissions. 2. Select your server and select Server Certificates in the Security menu. 6

7 3. From the Actions menu, select Create Certificate Request. 4. In the Server Certificates window that opens, fill in the fields for Common Name (name for your Apple developer account), Organization (legal name of your company), Organizational unit (your department), City, State, and Country and click Next. 5. In the Cryptographic Service Provider Properties window, select Microsoft RSA SChannel and 2048 (defaults), and click Next. 7

8 6. Enter a file name for the certificate request and click Finish, to save the CSR. 7. Using a Firefox or Safari browser, go to 8. Select Member Center. 9. Log into developer.apple.com as the Team Agent for your account and open ios Provisioning Portal > Certificates > Distribution. You ll need to be logged in as an Agent, not an Administrator. 10. Start creating your Enterprise MDM Certificate by clicking the New App ID button on the right: 8

9 11. Enter a name for your App ID and enter a Bundle Identifier in the free-form text field. The bundle id must be com.apple.mgmt.[companyname] for mdm certificates. Click Submit when you are done. A 10-character Bundle Seed ID is generated and concatenated with your Bundle Identifier. This string is your App ID. Production push is not yet enabled, however. 12. Locate the App ID you just created in the App IDs page. Click the Configure link to the right of the listing to register this App ID and configure a certificate for it. 13. Select Enable for Apple Push Notification service under the Manage tab then click the Configure button for one of the Certificates. 9

10 14. A windows opens to create a CSR, but you ve already done this. Click Continue. 15. Select Choose File to upload the CSR file you created. Click Generate. 10

11 The following screen confirms that you ve successfully generated a certificate: 16. After you finish creating the Client SSL certificate, click the Download button to download it: 11

12 17. Copy the file back to the Windows Server you used to create the CSR. 18. Return to Internet Information Services Manager > Server Certificates. Select Complete Certificate Request from the Actions menu. A Complete Certificate Request window opens. 12

13 19. Enter or browse to the.cer file that you saved. Enter a Friendly name that helps you identify the file. Click OK. The certificate is installed on the server. (You must have an Apple Root Certificate Authority set on the server ( 20. Export the certificate using the Personal Information Exchange (.p12) format. To do so, right-click on the certificate that you just imported, in the Server Certificates section and select Export. 21. Enter a password for export. You ll use this same password when uploading the cert to your GMC in the following step. 22. Import the.p12 file it into the Good Mobile Console software by using Settings > Certificates > Import. When you import, select the Personal Information Exchange (.p12) format. You can enter a Name and Description as free text, but the Password value must match the password you specified during.p12 export. Good Technology, Inc All rights reserved. Good, Good Technology, the Good logo, Good Mobile Messaging, Good Mobile Intranet, Good Mobile Defense, Good Mobile Application Services, GoodAccess, GoodInfo, GoodLink, and Powered by Good are trademarks of Good Technology, Inc. All other trademarks and service marks contained herein are the property of their respective owners. Good Technology, Inc., and its products are not related to, sponsored by, or affiliated with Research In Motion Limited. For information concerning other intellectual property rights of Good and others, go to 13