It is probably an iOS issue. Works on macOS 10.12 and 10.13:
Hardware Model: iPad4,4
Process: profiled [310]
Path: /System/Library/PrivateFrameworks/ManagedConfiguration.framework/Support/profiled
Identifier: profiled
Version: ???
Code Type: ARM-64 (Native)
Role: Unspecified
Parent Process: launchd [1]
Coalition: <none> [235]
Date/Time: 2017-11-09 00:25:30.8494 +0100
Launch Time: 2017-11-09 00:25:21.1574 +0100
OS Version: iPhone OS 10.3.3 (14G60)
Report Version: 104
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000000
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [0]
Triggered by Thread: 1
[...]
Thread 1 Crashed:
0 Security 0x00000001874f7c88 SecCmsAttributeCompareValue + 40
1 Security 0x00000001874fdd44 SecCmsSignerInfoVerify + 224
2 Security 0x00000001874fcb88 SecCmsSignedDataVerifySignerInfo + 140
3 Security 0x0000000187516564 SecCMSVerifySignedData_internal + 336
4 Security 0x0000000187516800 SecCMSVerifySignedData + 32
This is with a simple CA certificate, initialized with the scepserver:
scep@8bf4586be99b:/var/lib/scep/CA$ openssl x509 -in ca.pem -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = scep-ca, OU = SCEP CA
Validity
Not Before: Nov 8 23:24:05 2017 GMT
Not After : Nov 8 23:24:05 2027 GMT
Subject: C = US, O = scep-ca, OU = SCEP CA
The scep payloads look like that:
{"URL": "https://example.com/scep/",
"Subject": [[["CN", COMMON_NAME]],
[["2.5.4.5", SERIAL_NUMBER]],
[["O", BUSINESS_UNIT]]],
"Challenge": CHALLENGE,
"Keysize": 2048,
"KeyType": "RSA",
"KeyUsage": 5, # 1 is signing, 4 is encryption, 5 is both signing and encryption
}I have tried to force an SHA256WithRSA or SHA512WithRSA signature. Works fine on macOS. No Segmentation fault anymore on iOS, but “The scep server returned an invalid response”. HTTPS requests / responses OK on the server side.
Console logs on the iPad:
Nov 9 19:32:34 XXXXXXX Preferences(CoreFoundation)[499] <Notice>: Install profile data, interactive error. Error: NSError:
Desc : Profile Installation Failed
Sugg : The SCEP server returned an invalid response.
US Desc: Profile Installation Failed
US Sugg: The SCEP server returned an invalid response.
Domain : MCInstallationErrorDomain
Code : 4001
Type : MCFatalError
...Underlying error:
NSError:
Desc : The SCEP server returned an invalid response.
US Desc: The SCEP server returned an invalid response.
Domain : MCSCEPErrorDomain
Code : 22013
Type : MCFatalError
Extra info:
{
isPrimary = 1;
}
I have to admit, I am a bit lost. Any pointers ?
It is probably an iOS issue. Works on macOS 10.12 and 10.13:
This is with a simple CA certificate, initialized with the scepserver:
The scep payloads look like that:
{"URL": "https://example.com/scep/", "Subject": [[["CN", COMMON_NAME]], [["2.5.4.5", SERIAL_NUMBER]], [["O", BUSINESS_UNIT]]], "Challenge": CHALLENGE, "Keysize": 2048, "KeyType": "RSA", "KeyUsage": 5, # 1 is signing, 4 is encryption, 5 is both signing and encryption }I have tried to force an SHA256WithRSA or SHA512WithRSA signature. Works fine on macOS. No Segmentation fault anymore on iOS, but “The scep server returned an invalid response”. HTTPS requests / responses OK on the server side.
Console logs on the iPad:
I have to admit, I am a bit lost. Any pointers ?