I've been doing a ton of reading, and even found this question ( Device enrollment fails, error: server certificate is invalid ) and followed the instructions.

  • I first installed my Godaddy certificate in my Server.app
  • Then I enabled Wiki and Profile Manager, configuring the certificate and all that jazz.

When the invalid certificate error came up, I did some digging, and found the above thread.

  • I went and installed the intermediary certificate but didn't bother replacing the gd certificate, since it was already installed.
  • I rebooted the server for safe measure, and tried again.

Problem is, I'm still getting the same darn error... what could be up?

enter image description here

FYI: Here's the article regarding installing certs from Godaddy.

  • Are your iOS devices hitting the server from outside (WAN) or from an internal network? I've not had problems enrolling, but perhaps your iOS devices are not using the server as the DNS and resolving the IP address to match your SSL certificates? Also, I've not had issues with unsigned profiles, so perhaps try that to debug things and rule out network issues. – bmike Jan 9 '12 at 1:03
  • I'm on an internal network. I've got a Windows Server 2003 box doing all of my .local DNS. – Chase Florell Jan 9 '12 at 1:05
  • How could it be a DNS error if it works on my Macbook Pro? – Chase Florell Jan 9 '12 at 1:12
  • I get the exact same error if I uncheck "Sign configuration profiles". – Chase Florell Jan 9 '12 at 1:22

to allow the enrollment, I went to the Hardware and then select settings tab. there I went to custom SSL and then make sure that the certificate that was recognized by apple is selected for the web then it work...


Interesting Story.

I went into server certificates, created an unsigned certificate... enabled it and attached it to the Profile Manager. Tried to enroll, and FAILED.

Then I went back into server certificated, re-installed the signed Godaddy certificate... enabled it and attached it to the Profile Manager. This time, enrollment PASSED.

So freaking strange.


In general, I am doing a two step enrollment:

  1. From https://server.local/mydevices select Profiles and then install the Trust Profile
  2. Select Devices and then Enroll

I do make sure that DNS is running on the OSX server and only have two zones for the server IP itself and a forwarder to your preferred DNS server. Also, this works with unsigned certificates loaded, so you should be able to know fairly quickly that it's a DNS issue where the cert and the server are not matching if things work when you install the trust profile first.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .