SCEP operation ends up error with "signedData contains content but has no signers" in iOS16.4 and iPadOS 16.4 beta1

We have implemented MDM server, with SCEP operation by CA certification.

In iOS 16.4 beta1 and iPadOS 16.4 beta1, PKIOperation returned error below. In real data, SignerInfo seems to be assigned. What is reason of this error?

In iOS 16.3, anything went on successfully.

----------------------------- Occurred error --------------------------------- エラー 20:12:52.032987+0900 profiled signedData contains content but has no signers エラー 20:12:52.033035+0900 profiled decode failed for signedData due to RFC 5652 violation デフォルト 20:12:52.033073+0900 profiled failed to decode CMS message: Error Domain=MSErrorCMSDomain Code=-26275 "decode failed for signedData due to RFC 5652 violation" UserInfo={NSLocalizedDescription=decode failed for signedData due to RFC 5652 violation, NSUnderlyingError=0xa12a4e210 {Error Domain=MSErrorCMSDomain Code=-26275 "signedData contains content but has no signers" UserInfo={NSLocalizedDescription=signedData contains content but has no signers}}} デフォルト 20:12:52.033138+0900 profiled MessageSecurity and Security frameworks have different results, returning MessageSecurity result. sec: ( "" ), ms: (null) デフォルト 20:12:52.033768+0900 profiled Could not retrieve issued certificate: NSError: Desc : SCEPサーバは無効な応答を返しました。 US Desc: The SCEP server returned an invalid response. Domain : MCSCEPErrorDomain Code : 22013 Type : MCFatalError エラー 20:12:52.033921+0900 profiled Cannot retrieve SCEP identity: NSError: Desc : SCEPサーバは無効な応答を返しました。 US Desc: The SCEP server returned an invalid response. Domain : MCSCEPErrorDomain Code : 22013 Type : MCFatalError エラー 20:12:52.034368+0900 profiled Failure occurred while retrieving profile during OTA Profile Enrollment: NSError: Desc : SCEPサーバは無効な応答を返しました。 US Desc: The SCEP server returned an invalid response. Domain : MCSCEPErrorDomain Code : 22013 Type : MCFatalError -------------------------------------------------------------------------------

Got the same issue.

Is your CA for MDM signed by your companies CA, or is it something else?

We have the issue with our MDM too. Our SCEP CA is self-signed, not signed by our company CA. Out of curiosity, what is the MDM vendor you are facing the issue with? In our case it is Meraki SM.

This should be resolved as of 16.4 beta 4 per our apple case, confirmed by my own testing. This was done with Cisco Meraki Systems Manager.

Definitely not resolved on 16.4 beta 4 for me with Microsoft Intune.

Same issue with iOS 16.4 beta 4 and Intune

SCEP operation ends up error with "signedData contains content but has no signers" in iOS16.4 and iPadOS 16.4 beta1
 
 
Q