How can I Change the Apple Configuration Signing Certificate?

Question

I use the Apple Configurator to craft a Mobile Configuration Profile able to configure some settings such as the LDAP Directory as an example.

When exporting the profile, I check the "Sign" checkbox to sign the profile with the Apple Configurator certificate.

The problem is that when installing this profile on an iOS device, it is flagged "Non verified" and displays an alert when proceeding further.

Q: How do I change this obviously self-signed certificate with a valid one of my own?

No clue in the built-in help, neither in the prefs. Google does not seem to be helpful with this issue...

Answer 1

This is currently how the Apple Configurator works - it doesn't have a provision to load a certificate but instead generates self-signed ones automatically. If I run across a way to hack this, I'll link it here. If you need profiles to arrive with a signed certificate, look into Lion server or another MDM solution.

In practice - you only see the certificate warning when you are sitting in front of your Mac and connecting devices via USB. I'm not sure what additional layer of security a signed certificate can provide in this case. It's not like you are connecting to some remote server when these profiles get installed.

Answer 2

Start Apple Configurator 2, open your profile, select File -> Sign profile and choose your signing identity.

Make sure the identity is in the keychain 'System' in Keychain Access.

Answer 3

I just fixed this issue on my iPhone. Check your signing identities via command line:

security find-identity -p codesigning -v

Output:

1) 5DF418D498328BFE34255A2EE79178C742DF2909 "iPhone Developer..."
2) B955841D55F20FAE8290B403748CF8DFEFFAF3BE "iPhone Distribution..."
3) CFCDB0C4956FD307AA8E63915458778A651F80D6 "Apple Configurator 2: PureFocus..."

3 valid identities found

Then sign with developer instead if you're a software developer because that cert is on your phone: security cms -S -N "iPhone Developer: Ryan Dines (ULG3EK2E2S)" -I /Path/To/Input/Profile.mobileconfig -o /Path/ProfileSigned.mobileconfig

If not a developer, I'm sure there's a way to add the Apple Configurator cert to the trusted store of the phone, although not sure this will add much in the way of security.