Hello, As we’ve scaled out the deployment of our EAP-TLS network that uses PacketFence, I noticed an issue affecting a small percentage of Apple devices (macOS / iPadOS / iOS) relating to SCEP.
- We have Jamf Pro acting as a SCEP Proxy for configuration profiles - We’re using PacketFence for PKI and as a SCEP Server - We’re using Microsoft Entra as an Application Proxy to expose PF’s SCEP URL to the internet. This app proxy URL is listed as the base URL for the SCEP server in Jamf - The Jamf Pro configuration profiles we’re using for macOS and iPadOS/iOS are very similar and contain: - PacketFence Root Certificate - SCEP Payload specifying the CN subject to use for SCEP-issued machine certificates, retry delay, etc. - WiFi payload specifying SSID, auto-join, what username to use, etc. The issue we are seeing with a fairly small number of devices (it’s currently affecting less than 2% of macOS and a little over 4% of iPadOS/iOS) are two Jamf Pro errors correlating with the configuration profile failing to push: - Unable to obtain certificate from SCEP server at “our_Jamf_URL”. <MDM-SCEP:14006> - The SCEP server returned an invalid response. What is strange is that for these devices where the Jamf config profile is failing, I can find active SCEP certificates in PacketFence (Configuration > Integration > Certificates). They all show up in there and SCEP shows a green circle. I can manually revoke the SCEP machine certificate for a device that failed in PacketFence, then re-push the Jamf config profile, and then it will install fine. So why are Jamf configuration profiles failing only on a small minority of devices (with SCEP errors)? Probably related - why is PacketFence provisioning a SCEP certificate for them that Jamf is failing to install? I’m wondering if there is a setting we need to adjust somewhere since that vast majority of devices are working fine. Thanks, Brad White Client Systems Analyst Peninsula School District whi...@psd401.net 253.530.3710
_______________________________________________ PacketFence-users mailing list PacketFence-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/packetfence-users