We plan to roll out FileVault via Apple's own MDM (Server.app). I already have some test-computers enrolled.

When I look at the certificate used for the Institutional Recovery Key, it expires in March 2019. It's a self signed certificate (created like this).

Do I need to renew this certificate? I can't find any info on this.

  • 2
    You will need to renew. I’m on the operational end of certificates (installing certificates in profiles on iOS and tvOS devices through a third-party MDM and Apple Configurator) but I don’t create or maintain them myself. Out-of-date certificates can cause pain and anguish. – IconDaemon Dec 17 '18 at 10:21
  • 1
    For macOS in this case it is not needed, since you're using a self-signed certificate. It was confirmed by Rich Trouton's talk on managing FileVault on High Sierra. – doekman Dec 17 '18 at 16:10
  • I think the lack of expiration control on a self signed certificate is an error. What is the purpose of the expiration date in this case? – dan Dec 19 '18 at 11:35
  • I'm not sure. As far as I know it's an standard self-signed SSL certificate. – doekman Dec 20 '18 at 13:28

I advise you to test this by setting a test Mac and then starting it with a date set to April the 1st of 2019 (just after your certificate expiration date). Of course, for this test to work you will need to deactivate any automatic time synchronization:

System Preferences... > Date & Time

turn off:

Set Date & Time automatically
  • 1
    Good thinking! I'll try and let you know. – doekman Dec 17 '18 at 11:59
  • 1
    Indeed. It is not needed. – doekman Dec 17 '18 at 16:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .