Discover Managed Device Attestation

RSS for tag

Discuss the WWDC22 Session Discover Managed Device Attestation

Posts under wwdc2022-10143 tag

8 Posts

Post

Replies

Boosts

Views

Activity

How to trigger intervalDidStart in DeviceActivity API?
I have followed the two videos about Screen time API in wwdc 21 and 22. Now i want to sheild some apps during sleeping, but I encounter some problems. Problem I faced I write my monitor and override intervalDidStart and intervalDidEnd . Here is a simplified version class Mymonitor: DeviceActivityMonitor { let store = ManagedSettingsStore() override func intervalDidStart(for activity: DeviceActivityName) { super.intervalDidStart(for: activity) store.shield.applications = selection.applicationToken } then I use deviceActivityCenter to start monitor func StartSleep (_ startTime : DateComponents) {   let schedule = DeviceActivitySchedule(intervalStart: startTime,                      intervalEnd: DateComponents(hour: 4, minute: 0),                      repeats: true                      )   let center = DeviceActivityCenter()   center.stopMonitoring([.daily])   try! center.startMonitoring(.daily, during: schedule) } However, when I use StartSleep. The applications is not shielded. I have noticed that I haven't use Mymonitor in any place. In the demo Code, it seems i just need to finish two parts (DeviceActivityMonitor and DeviceActivityCenter). But in the DeviceActivityCenter i do not use Mymonitor. Then how can i triggger intervalDidStart that i overwrited? Do i miss other details. Where can i use Mymonitor? Troubleshooting I have successfully shield apps using store.shield.applications = selection,applicationToken directly. Thanks for your reading and help!
2
1
1.2k
Feb ’23
“ACME Certificate” payload contains an invalid value for the key “HardwareBound”
We are testing the ACMECertificate payload in Mac 13.1 beta and getting this error. The same payload when sent to iOS works fine. Any help on this would be appreciated. Thanks. FB Raised: FB11736586 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>70e4b45e3c1e</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadOrganization</key> <string>NewComp</string> <key>PayloadIdentifier</key> <string>4565353a3a84</string> <key>PayloadDisplayName</key> <string>ACME</string> <key>PayloadRemovalDisallowed</key> <true/> <key>PayloadContent</key> <array> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>f84ef110e39b</string> <key>PayloadType</key> <string>com.apple.security.acme</string> <key>PayloadOrganization</key> <string>NewComp</string> <key>PayloadIdentifier</key> <string>f84ef110e39b</string> <key>PayloadDisplayName</key> <string>ACME Configuration</string> <key>DirectoryURL</key> <string>https://acmeserver/acme/acme/directory</string> <key>ClientIdentifier</key> <string>test</string> <key>HardwareBound</key> <true/> <key>KeyType</key> <string>ECSECPrimeRandom</string> <key>KeySize</key> <integer>384</integer> <key>Subject</key> <array> <array> <array> <string>1.2.840.113549.1.9.1</string> <string>test@test.com</string> </array> </array> </array> <key>SubjectAltName</key> <dict> </dict> <key>KeyUsage</key> <integer>5</integer> <key>Attest</key> <true/> </dict> </array> </dict> </plist>
2
0
1.5k
Dec ’22
Unable to test ACME payload
Hello All, We are looking to implement the ACME protocol for our organization PKI and as of now, we are trying out the demo ACME server hosted here. So far, we had a minor piece of luck in getting it to work properly twice, but after that, it errors out every time. This is the payload we are using: &amp;amp;lt;?xml version="1.0" encoding="UTF-8"?&amp;amp;gt; &amp;amp;lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&amp;amp;gt; &amp;amp;lt;plist version="1.0"&amp;amp;gt; &amp;amp;lt;dict&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadContent&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;dict&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;ClientIdentifier&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;123123123123123123123&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;ExtendedKeyUsage&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;1.3.6.1.5.5.7.3.2&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;HardwareBound&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;true/&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;KeySize&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;integer&amp;amp;gt;384&amp;amp;lt;/integer&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;KeyType&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;ECSECPrimeRandom&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;KeyUsage&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;integer&amp;amp;gt;5&amp;amp;lt;/integer&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadIdentifier&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;com.example.test&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadType&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;com.apple.security.acme&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadUUID&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;sdf-feec-4171-878d-34e576bbb813&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadVersion&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;integer&amp;amp;gt;1&amp;amp;lt;/integer&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;Subject&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;C&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;US&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;O&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;Example Inc.&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;CN&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;test&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;SubjectAltName&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;dict&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;dNSName&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;site.example.com&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/dict&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;DirectoryURL&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;https://ca.attestation.dev/acme/acme/directory&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/dict&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadDisplayName&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;ACME&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadIdentifier&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;com.example.test&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadType&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;Configuration&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadUUID&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;ce876f81-abf0-46f9-9e68-9b3a7ede8097&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadVersion&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;integer&amp;amp;gt;1&amp;amp;lt;/integer&amp;amp;gt; &amp;amp;lt;/dict&amp;amp;gt; &amp;amp;lt;/plist&amp;amp;gt; We get the below errors from the ACME server: order status is "pending", not yet "valid" order status is "ready", not yet "valid" Any insights on what we are doing wrong could be helpful. Thanks in advance.
5
0
2.1k
Oct ’22
Multiple SAN for ACMECertificate payload
Hi, For the SCEP payload's SAN, we are able to provide an array of strings for each key (dNSName, ntPrincipalName). <dict> <key>ntPrincipalName</key> <string>email</string> <key>rfc822Name</key> <array> <string>email</string> <string>email2</string> </array> <key>dNSName</key> <array> <string>test.com</string> <string>example.com</string> </array> </dict> But the ACMECertificate payload is not accepting this and instead, returns the below error. The field “rfc822Name” is invalid. The field “dNSName” is invalid. Does the ACMECertificate payload support multiple SAN values for each key? Thanks for your time!
2
0
1.2k
Sep ’22
Missing Nonce in attestation certificate
Hi, I'm implementing support for device attestation support on step-ca, and the attestation certificate, the leaf one in the x5c payload, doesn't include the nonce extension with the challenge token or the SHA256 version of it as it explains in https://developer.apple.com/videos/play/wwdc2022/10143/ Is this implemented? Can it be a device-related problem, meaning that older models do not support this?
2
0
1.4k
Jul ’22
Managed Device Attestation - ACME - Request Authorization
I'm curious about suggested workflows for a 3rd party ACME server handling a request for a managed device. Specifically, when the MDM server does not control the ACME server like it likely would when using the ACME payload for the MDM client identity. i.e., an organization with a CA that can distribute client identities using ACME; how should ACME servers validate the request is authorized? The server, of course, would be able to validate that the attestation is valid from Apple, but how would an ACME server validate that the request is authorized for a device? I would assume that the ACME server would use the ClientIdentifier key similarly to a SCEP challenge. And that identifier should be populated in MDM either as a static challenge or dynamically fetched by MDM from the ACME service? Or possibly that the ACME service would need a connection (i.e., through a restful API) to the MDM server to validate it is a device under management and fetch the generated client identifier and therefore determine that the device is authorized to request certs from the enterprise CA? It would be great if the device could attest that it is under management and have an OID for the check-in URL or the APNS topic is registered against. This might eliminate the ACME server's need to authorize a request against the MDM server or help improves the validation of the request etc. In any case, I'm curious on folks' thoughts around this in general :)
2
0
2.0k
Jun ’22
How to trigger intervalDidStart in DeviceActivity API?
I have followed the two videos about Screen time API in wwdc 21 and 22. Now i want to sheild some apps during sleeping, but I encounter some problems. Problem I faced I write my monitor and override intervalDidStart and intervalDidEnd . Here is a simplified version class Mymonitor: DeviceActivityMonitor { let store = ManagedSettingsStore() override func intervalDidStart(for activity: DeviceActivityName) { super.intervalDidStart(for: activity) store.shield.applications = selection.applicationToken } then I use deviceActivityCenter to start monitor func StartSleep (_ startTime : DateComponents) {   let schedule = DeviceActivitySchedule(intervalStart: startTime,                      intervalEnd: DateComponents(hour: 4, minute: 0),                      repeats: true                      )   let center = DeviceActivityCenter()   center.stopMonitoring([.daily])   try! center.startMonitoring(.daily, during: schedule) } However, when I use StartSleep. The applications is not shielded. I have noticed that I haven't use Mymonitor in any place. In the demo Code, it seems i just need to finish two parts (DeviceActivityMonitor and DeviceActivityCenter). But in the DeviceActivityCenter i do not use Mymonitor. Then how can i triggger intervalDidStart that i overwrited? Do i miss other details. Where can i use Mymonitor? Troubleshooting I have successfully shield apps using store.shield.applications = selection,applicationToken directly. Thanks for your reading and help!
Replies
2
Boosts
1
Views
1.2k
Activity
Feb ’23
Managed Device Attestation for macOS
Can the new ACME payload work on macOS 13 seed builds as well ? Is there anything that stops a ACME payload for macOS ? This will be an awesome support for Macs in the enterprises with DEP/MDM.
Replies
3
Boosts
0
Views
1.6k
Activity
Dec ’22
“ACME Certificate” payload contains an invalid value for the key “HardwareBound”
We are testing the ACMECertificate payload in Mac 13.1 beta and getting this error. The same payload when sent to iOS works fine. Any help on this would be appreciated. Thanks. FB Raised: FB11736586 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>70e4b45e3c1e</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadOrganization</key> <string>NewComp</string> <key>PayloadIdentifier</key> <string>4565353a3a84</string> <key>PayloadDisplayName</key> <string>ACME</string> <key>PayloadRemovalDisallowed</key> <true/> <key>PayloadContent</key> <array> <dict> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadUUID</key> <string>f84ef110e39b</string> <key>PayloadType</key> <string>com.apple.security.acme</string> <key>PayloadOrganization</key> <string>NewComp</string> <key>PayloadIdentifier</key> <string>f84ef110e39b</string> <key>PayloadDisplayName</key> <string>ACME Configuration</string> <key>DirectoryURL</key> <string>https://acmeserver/acme/acme/directory</string> <key>ClientIdentifier</key> <string>test</string> <key>HardwareBound</key> <true/> <key>KeyType</key> <string>ECSECPrimeRandom</string> <key>KeySize</key> <integer>384</integer> <key>Subject</key> <array> <array> <array> <string>1.2.840.113549.1.9.1</string> <string>test@test.com</string> </array> </array> </array> <key>SubjectAltName</key> <dict> </dict> <key>KeyUsage</key> <integer>5</integer> <key>Attest</key> <true/> </dict> </array> </dict> </plist>
Replies
2
Boosts
0
Views
1.5k
Activity
Dec ’22
Unable to test ACME payload
Hello All, We are looking to implement the ACME protocol for our organization PKI and as of now, we are trying out the demo ACME server hosted here. So far, we had a minor piece of luck in getting it to work properly twice, but after that, it errors out every time. This is the payload we are using: &amp;amp;lt;?xml version="1.0" encoding="UTF-8"?&amp;amp;gt; &amp;amp;lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&amp;amp;gt; &amp;amp;lt;plist version="1.0"&amp;amp;gt; &amp;amp;lt;dict&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadContent&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;dict&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;ClientIdentifier&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;123123123123123123123&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;ExtendedKeyUsage&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;1.3.6.1.5.5.7.3.2&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;HardwareBound&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;true/&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;KeySize&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;integer&amp;amp;gt;384&amp;amp;lt;/integer&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;KeyType&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;ECSECPrimeRandom&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;KeyUsage&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;integer&amp;amp;gt;5&amp;amp;lt;/integer&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadIdentifier&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;com.example.test&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadType&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;com.apple.security.acme&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadUUID&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;sdf-feec-4171-878d-34e576bbb813&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadVersion&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;integer&amp;amp;gt;1&amp;amp;lt;/integer&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;Subject&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;C&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;US&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;O&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;Example Inc.&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;array&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;CN&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;test&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;SubjectAltName&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;dict&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;dNSName&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;site.example.com&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/dict&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;DirectoryURL&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;https://ca.attestation.dev/acme/acme/directory&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;/dict&amp;amp;gt; &amp;amp;lt;/array&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadDisplayName&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;ACME&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadIdentifier&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;com.example.test&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadType&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;Configuration&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadUUID&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;string&amp;amp;gt;ce876f81-abf0-46f9-9e68-9b3a7ede8097&amp;amp;lt;/string&amp;amp;gt; &amp;amp;lt;key&amp;amp;gt;PayloadVersion&amp;amp;lt;/key&amp;amp;gt; &amp;amp;lt;integer&amp;amp;gt;1&amp;amp;lt;/integer&amp;amp;gt; &amp;amp;lt;/dict&amp;amp;gt; &amp;amp;lt;/plist&amp;amp;gt; We get the below errors from the ACME server: order status is "pending", not yet "valid" order status is "ready", not yet "valid" Any insights on what we are doing wrong could be helpful. Thanks in advance.
Replies
5
Boosts
0
Views
2.1k
Activity
Oct ’22
ACME Certificate Key Size is displayed as 0
Hi, We are testing the ACMECertificate payload and noticed that in the device's configuration, the key size is displayed as 0. Thanks in advance.
Replies
2
Boosts
0
Views
1.2k
Activity
Sep ’22
Multiple SAN for ACMECertificate payload
Hi, For the SCEP payload's SAN, we are able to provide an array of strings for each key (dNSName, ntPrincipalName). <dict> <key>ntPrincipalName</key> <string>email</string> <key>rfc822Name</key> <array> <string>email</string> <string>email2</string> </array> <key>dNSName</key> <array> <string>test.com</string> <string>example.com</string> </array> </dict> But the ACMECertificate payload is not accepting this and instead, returns the below error. The field “rfc822Name” is invalid. The field “dNSName” is invalid. Does the ACMECertificate payload support multiple SAN values for each key? Thanks for your time!
Replies
2
Boosts
0
Views
1.2k
Activity
Sep ’22
Missing Nonce in attestation certificate
Hi, I'm implementing support for device attestation support on step-ca, and the attestation certificate, the leaf one in the x5c payload, doesn't include the nonce extension with the challenge token or the SHA256 version of it as it explains in https://developer.apple.com/videos/play/wwdc2022/10143/ Is this implemented? Can it be a device-related problem, meaning that older models do not support this?
Replies
2
Boosts
0
Views
1.4k
Activity
Jul ’22
Managed Device Attestation - ACME - Request Authorization
I'm curious about suggested workflows for a 3rd party ACME server handling a request for a managed device. Specifically, when the MDM server does not control the ACME server like it likely would when using the ACME payload for the MDM client identity. i.e., an organization with a CA that can distribute client identities using ACME; how should ACME servers validate the request is authorized? The server, of course, would be able to validate that the attestation is valid from Apple, but how would an ACME server validate that the request is authorized for a device? I would assume that the ACME server would use the ClientIdentifier key similarly to a SCEP challenge. And that identifier should be populated in MDM either as a static challenge or dynamically fetched by MDM from the ACME service? Or possibly that the ACME service would need a connection (i.e., through a restful API) to the MDM server to validate it is a device under management and fetch the generated client identifier and therefore determine that the device is authorized to request certs from the enterprise CA? It would be great if the device could attest that it is under management and have an OID for the check-in URL or the APNS topic is registered against. This might eliminate the ACME server's need to authorize a request against the MDM server or help improves the validation of the request etc. In any case, I'm curious on folks' thoughts around this in general :)
Replies
2
Boosts
0
Views
2.0k
Activity
Jun ’22