SSL Trust of mobileconfig Profile installed CA certificates

Are you installing this profile via MDM? Or manually?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Thank you for your response. The profile is installed manually. A .mobileconfig file is downloaded from a web interface and the user is instructed to install via the Profiles section within System Settings.

OK. This is more of a user-level question than a code-level question, which means I’m not really the right person to give you definitive answers. However, my understanding is that this is a deliberate change to bring macOS more in line with iOS. On iOS you have to manually trust a user-installed root certificate (in Settings > General > About > Certificate Trust Settings) and now that’s the case on macOS as well.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Did you figure out what the issue was here? I'm seeing this behavior just with a .mobileconfig created with Apple Configurator and not seeing how to change it. There must be a new plist key somewhere--this seems like a crucial thing to be able to make work, kind of a major reason to distribute CAs for internal PKI in the first place.

Actually, I am seeing essentially the same behavior with the same trust profile .mobileconfig when installed on iOS 17. I have to go to Settings > About > Certificate Trust Settings, and slide the switch next to the root certificate under "ENABLE FULL TRUST FOR ROOT CERTIFICATES" in order for anything below it in a chain to be trusted for HTTPS/TLS.

This document describes this process, but it says "Certificate payloads are trusted for SSL automatically when installed with Configurator, MDM or as part of an MDM enrolment profile." This is apparently untrue, because I installed this profile on iOS 17 with Apple Configurator, and I installed it on macOS systems via MDM. Clearly there is another factor here that is required. (Full disclosure: my profile is currently unsigned, but the OP says his was signed... nevertheless the linked document does not specify that the profile must be signed. My iOS device is also unmanaged, but the macOS systems are MDM managed... but again, a managed device is not listed as a requirement at the above link)

I understand the need to very carefully protect installation of root certificates... but whatever has changed in Ventura (and apparently iOS 17) seems to be completely undocumented and no one thinks security-by-obscurity is a good policy. I also found a Jamf support post where a large group of users are baffled by this same problem. This is impacting a large chunk of important users in Apple's ecosystem...the documentation here--at a minimum--should be better on whatever the problem is here.