component=scep_service method=PKIOperation err="invalid data len 0"

[xndr]

I use an Apple configuration profile to set the SCEP and 802.1X configuration on Mac computers, and this particular configuration template runs fine on macOS 10.13 through 10.15, however, on an older system, which accepts the config profile just fine, it causes an error / rejection on the MicroMDM/SCEP server (but with the same config template, is able to obtain a SCEP certificate from a different SCEP server. The operating system is still supported and supports TLS 1.2.

I've included a screenshot of the configuration template for the SCEP client.

Error in the scepserver logs:

level=info ts=2021-03-18T16:09:24.195342904Z caller=logutil.go:70 component=http method=GET status=200 proto=HTTP/1.1 host=192.168.1.6 user_agent="mdmclient/863 CFNetwork/760.9 Darwin/15.6.0 (x86_64)" path="/scep?operation=GetCACaps&message="
level=info ts=2021-03-18T16:09:24.199474783Z caller=service_logging.go:34 component=scep_service method=GetCACert err=null took=1.332µs
level=info ts=2021-03-18T16:09:24.199560295Z caller=endpoint.go:186 op=GetCACert error=null took=137.313µs
level=info ts=2021-03-18T16:09:24.199623083Z caller=logutil.go:70 component=http method=GET status=200 proto=HTTP/1.1 host=192.168.1.6 user_agent="mdmclient/863 CFNetwork/760.9 Darwin/15.6.0 (x86_64)" path="/scep?operation=GetCACert&message="
level=info ts=2021-03-18T16:09:35.135787804Z caller=service_logging.go:46 component=scep_service method=PKIOperation err="invalid data len 0" took=22.040839ms
level=info ts=2021-03-18T16:09:35.13597859Z caller=endpoint.go:186 op=PKIOperation error=null took=22.233309ms
level=info ts=2021-03-18T16:09:35.136059909Z caller=logutil.go:70 component=http method=POST status=500 proto=HTTP/1.1 host=192.168.1.6 user_agent="mdmclient/863 CFNetwork/760.9 Darwin/15.6.0 (x86_64)" path="/scep?operation=PKIOperation"

[jessepeterson]

What version of scepserver are you using? What OS is this system running? I have a tester that runs macOS 10.12 which seems to work fine. We had an older issue in MicroMDM micromdm/micromdm#436 that presented like this a couple years ago that was fixed with a library update in #87.

[xndr]

This is running a git clone from about ~3 weeks ago, I can get the commit ID tomorrow. Running on 10.11.6 (still getting updates on enterprise support). Let me know if there's any debug output or anything you would like me to test.

[jessepeterson]

still getting updates on enterprise support

Not sure what you mean here.

But: interestingly we had a regression with this when we moved PKCS7 libraries (yet again) which was fixed (again) in #128 which was ~29 days ago. Three weeks ago would have had this fix included by about a week but I would still be curious the specific commit you're at and if a pull up to main would help. It is interesting that 10.13+ works, though, so makes me think you have that fix included.

Separately I see that you're using 4096 bit keys — I wonder if that's not supported (well) on the older OS? Maybe a smaller key a try? Wonder if I can dust off a copy of 10.11 from days of yore.

[jessepeterson]

I was able to get an OS X 10.11 (VM) install a SCEP profile fine using the latest. My SCEP payload in the profile looks like this:

<key>PayloadContent</key>
<dict>
    <key>Keysize</key>
    <integer>2048</integer>
    <key>URL</key>
    <string>http://127.0.0.1:8080/scep</string>
</dict>

I'm pretty sure this is related to the PKCS7 issue and it's working for me. I'm gonna close this for now.

[jessepeterson]

Definitely try this again. If this was from the same version in the other issue (v1.0.0-48-g860c08c) then the fix #128 was merged just a day after your checkout.