1

I created Open Directory and ProfileManager with self-signed certificate. Now I try to replace the self-signed certificate with the already Signed Certificated currently use on our Active Directory 2008.

I do an Export .pfx cert from this link: http://www.digicert.com/ssl-support/pfx-import-export-iis-7.htm

When I try "Import a Certificate Identity" from Certificate Menu on Left Sidebar of Server.app the application hangs.

I also use the keychain to import .pfx by follow this link http://www.digicert.com/ssl-support/p12-import-export-mac-server.htm but it also not available in Server.app Certificate.

Is there any command line that could help or a better way to add a private key + cert to Server.app?

Improve this question

1 Answer 1

Reset to default
2

You need to import the cert via Server.app; that'll add it to the System keychain and several other locations that allow non-keychain-aware services to use it. I'm not sure why it'd be hanging, but I can think of a few things to try:

  • If it's not a self-signed certificate, you probably need to import the appropriate intermediate certificate(s) by dragging them into the "Drag extra non-identity certificates here" section of the import dialog. If it's a DigiCert certificate, you can find their intermediate certs here. There's probably also a way to export this from the Windows server, but I'm not familiar enough with it.

  • It's possible Server.app is getting confused by the file extension. Try renaming it from .pfx to .p12 (they both refer to the same file format, PKCS #12).

  • There might also be something odd about the file contents. Since it sounds like it imports ok via Keychain Access, try importing it with that, then re-exporting it to .p12 (see the instructions you linked), then delete it from the keychain (to avoid a conflict) and re-import it with Server.app. It's possible importing and exporting with Keychain Access will clean up the file and make it work properly in Server.app as well.

Improve this answer
3
  • Hi Gordon, I try to export .p12 and re-import them and it appear in the "Import a Certificate Identity" dialog as both public and private key but it not available as new cert when I click import, I try import at Code Signing certificate at Profile Manager setting but it pop out an error message "The imported certificate is not a code signing certificate and cannot be used to sign profiles." I think something wrong with my exported cert from windows server. Would you mind providing me some suggestion to resolve this? thank you so much
    – billyduc
    Jan 20, 2014 at 1:25
  • 1
    It sounds like you have an SSL certificate, not a code signing certificate. These are different types of certificate, and you actually want one of each for the Profile Manager service -- an SSL certificate for the web service (since the PM service delivers profiles via the web), and a code signing cert so the client devices can verify the authenticity of the certs once they're delivered. It might help if you told me more about the cert you're trying to use: where is it from, how was it created, how was it used on the Windows server, etc.
    – Gordon Davisson
    Jan 20, 2014 at 18:06
  • Hi Gordon, I was able to resolve my own question. The flow is like below: I create a signing request from server.app and then in Certificate Authority from Active Directory I create a new Certificate template named Code Signing and then sign the CSR with that template, finally I import the certificate and it work on Profile Manager!
    – billyduc
    Jan 21, 2014 at 0:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .