Issue with MDM InstallApplication manifest retrieval with mutual TLS

We have a development where we are MDM managing iOS devices and attempting to enforce mutual TLS for all interactions with the MDM. We are DEP provisionng an enrolment profile that utilises an ACME hardware attested Device Identity Certificate. All interactions with the MDM endpoints are correctly utilising the ACME certificate for the client mutual TLS handshake. The certificate has Client Authentication Extended Key Usage.

Behind the same API gateway and on the same SNI we are also serving paths to Enterprise application manifests and IPAs. We can see from the phone log and from packet traces the iOS device doesn't offer the Device Identity Certificate for client authentication when retrieving these URLs. We have also tried adding non ACME client certificates from the root trusted by the server to the initial profile with exactly the same outcome.

If we temporarily disable the mutualTLS we can see that the request for the manifest has a userAgent of

"com.apple.appstored/1.0 iOS/18.2 model/iPhone17,3 hwp/t8140 build/22C5125e (6; dt:329) AMS/1"

which is not the same as the mdm interactions. Is it actually possible to achieve mutualTLS to authenticate these downloads or is a different solution required ?

Any advice greatly appreciated.

There is a discussion at

https://macadmins.slack.com/archives/C5238RU9X/p1732187435343649

that covers most of this issue. It doesn't explicitly say why a different non-identity cert payload isn't used and also if I navigate to the enterprise application path in Safari it prompts me to use the Device Identity cert for client authentication and then server the page

Issue with MDM InstallApplication manifest retrieval with mutual TLS
 
 
Q