I am planning for hundreds of iPad devices that should enroll into MDM using a DEP certificate setting but the network in use inspects SSL/TLS traffic using man in the middle technique in order to decide if outgoing traffic is allowed or not.

Will this inspection prevent enrollment?

  • Welcome to Ask Different. Are you looking to troubleshoot an iPad that is failing to enroll because of man in the middle proxy/breakage? Or are you looking to snoop on the traffic so you can reverse engineer it?
    – bmike
    Dec 23 '15 at 19:13
  • @bmike I'm going to enroll hundreds of iPads in a network that traffic will be allowed to Apple only if that traffic can be inspected (man in the middle) and I'm trying to visualize problems. So, I'm still not trying to troubleshoot anything but trying to avoid problems. Dec 24 '15 at 7:40
  • OK - I've tried to edit this so it's more a clear question - will this work. If you want to report results from one test enrollment and ask how to make it work - we'd need to know more about how SSL/MITM inspection works. Inspection doesn't modify the actual traffic - my guess is your setup actually tampers with the traffic endpoints and isn't just "inspection" but the details of the MITM will make/break this...
    – bmike
    Dec 24 '15 at 15:58
  • When performing man-in-the-middle a) the endpoint initiating the connection is alerted and must accept to continue or b) in the endpoint initiating the connection the root CA that is generating the fake certificate is installed. In my case I would like to install the root CA in the iPads but I do not know if it is possible or if this root CA can be installed automatically (remember, hundreds of devices in my case). Being an automatic process I also don't know if the user will be warned or not if the root CA is not installed... Dec 24 '15 at 16:18
  • 1
    Yeah - that's not going to work. DEP is to enroll the device into MDM so that you can push these "fake" certs without user interaction. Your cart is before your horse if I'm understanding how your MITM is set up.
    – bmike
    Dec 24 '15 at 16:25

The DEP program as well as iOS security design out of the box will likely foil your attempts to enroll a device using networks where you need to install custom CA/certificates.

  1. iOS does not automate silent installation of trust certificates without being enrolled in MDM or supervised. You would be preventing this initial enrollment unless you have what amounts to an illegal cert that makes your MITM servers look like Apple owned and operated. I say illegal in the sense that comodo, symantec and others are in hot water from Apple, Google and other OS vendors for issuing certificates to entities that are not what the certificate says.
  2. Once you have the devices entered into your MDM, you can then push wifi profiles and your CA certs and then join the networks where you are "inspecting" SSL/TLS and other encrypted traffic between iOS and Apple or at least attempt to decrypt/re-encrypy/inspect that traffic.
  3. DEP runs at a point in the OS setup that users can't even accept a custom certificate - this runs before the home screen is initially presented to users as part of the setup script / out of box experience.

This is documented at https://www.apple.com/business/dep/ and https://ssl.apple.com/business/docs/DEP_Guide.pdf and I would reach out to your Apple contact that established your "sold to" account for assistance in this.

I wouldn't want to surprise Apple with what you're doing and risk them shutting down your DEP. Also they have engineers that can guide you if other large customers have the same "inspection" needs that you do and there are either undocumented ways to get around the design or otherwise clear only the initial traffic to Apple and then inspect things once the devices are enrolled.

You will have detailed legal agreements with Apple when you sign up for DEP, so you'll want to read through them as well since Apple vets organizations quite thoroughly, you can probably get excellent help directly from Apple if you've already jumped through all the hoops to be qualified for DEP in the first place.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .