How to troubleshoot device-attest-01 on mac ?

[udf2457]

I have a mobileconfig created in-line with the example given by Apple at https://developer.apple.com/documentation/devicemanagement/acmecertificate#Example-Profile

I have the root CA installed and fully-trusted on the mac (i.e.curl https://..../provisioners and curl https://.../acme/$MY_NAME_GOES_HERE/directory on the mac returns without error)

Attempted installation of the profile yields:

1. Profile installation failed: bad request on the mac
2. /usr/local/go/src/net/http/server.go:3677: http: TLS handshake error in the step-ca logs

Both are obscure messages that don't tell me much. Am I looking in the wrong place for more detail on the step-ca side or is that obscure message all I'll get ?

The TLS handshake is clearly a red-herring because as I said, curl https://..../provisioners and curl https://.../acme/$MY_NAME_GOES_HERE/directory on the mac returns without error, i.e. curl recognises the trusted root.

The connection is not proxied, it is direct.

[tashian]

It sounds like a TLS trust error.
Did you try also trusting the intermediate CA on macOS? Sometimes that can help.
Another thing is, it's important that the "SSL" trust setting is enabled for the CA(s) in Keychain Access.
There are MDM client logs that you can look at on macOS as well.

[udf2457]

Hi @tashian

Yes, tried intermediate.
Yes, "SSL" enabled ...curl test wouldn't work without it.

Could you point me in the direction of MDM client logs ? Are they hidden in the streaming console log output, or somewhere else ?

[udf2457]

Safari is happy, Chrome is happy.

Firefox complains, but that is to be expected as Firefox has always done its Own Thing (TM) with certs...

[tashian]

Yes, the MDM client logs are in the streaming console log output.

[hslatman]

Did you enable full trust: https://support.apple.com/en-eg/102390?

[udf2457]

Did you enable full trust: https://support.apple.com/en-eg/102390?

At present I am trying to get this working on desktop (macOS), hence my prior comments about curl complaining until I enabled full trust in the root.

So the answer to your question is yes. On macOS the root is fully trusted in Keychain.

[udf2457]

Yes, the MDM client logs are in the streaming console log output.

I was worried you might say that @tashian ! I've tried looking but even quick-fire pause and manual scroll-back I can't see anything of interest. Any ideas of strings worth filtering on ?