The SCEP server returned an invalid response

[chrsvl]

Hi,

I tried to use you great code to enroll my iPhone in MDM. It works great till the POST "/scep?operation=PKIOperation", at which point the iPhone raises the error "The SCEP server returned an invalid response". I wanted to know more about that so I gave a look at the device's logs:

Aug 1 09:00:42 TheVilain Preferences[11159] : BTM: attaching to BTServer
Aug 1 09:00:46 TheVilain profiled[11158] : (Note ) MC: Checking for MDM installation...
Aug 1 09:00:46 TheVilain profiled[11158] : (Note ) MC: ...finished checking for MDM installation.
Aug 1 09:00:54 TheVilain wifid[15] : WiFi:[428569254.463576]: WiFiLocaleManagerCheckLocale: locale has been valid since 428569213.178916, for 41.28 secs
Aug 1 09:00:54 TheVilain kernel[0] : 493937.610838 wlan.A[80756] AppleBCMWLANProximityInterface::setSYNC_ENABLED(): set AWDL->OFF
Aug 1 09:00:54 TheVilain kernel[0] : 493937.610908 wlan.A[80757] AppleBCMWLANProximityInterface::doSetSyncState(): Setting fAWDLOffTimer
Aug 1 09:00:55 TheVilain profiled[11158] : (Note ) MC: Enrolling in OTA Profile service...
Aug 1 09:00:56 TheVilain securityd[8501] : SecDbItemInsertOrReplace INSERT failed: The operation couldn’t be completed. (com.apple.utilities.sqlite3 error 19 - reset: [19] columns ctyp, issr, slnr, agrp, sync are not unique sql: INSERT INTO cert(rowid,cdat,mdat,ctyp,cenc,labl,alis,subj,issr,slnr,skid,pkhh,data,agrp,pdmn,sync,tomb,sha1)VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?))
Aug 1 09:00:56 TheVilain securityd[8501] : securityd_xpc_dictionary_handler profiled[11158] add The operation couldn’t be completed. (OSStatus error -25299 - duplicate item O,cert,5359E7E8,L,dku,com.apple.certificates,0,ctyp,cenc,labl,subj,issr,slnr,pkhh,v_Data,20140801070056.363791Z,DE2E9186)
Aug 1 09:00:56 TheVilain profiled[11158] : SecOSStatusWith error:[-25299] The operation couldn’t be completed. (OSStatus error -25299 - Remote error : The operation couldn‚Äôt be completed. (OSStatus error -25299 - duplicate item O,cert,5359E7E8,L,dku,com.apple.certificates,0,ctyp,cenc,labl,subj,issr,slnr,pkhh,v_Data,20140801070056.363791Z,DE2E9186))
Aug 1 09:00:56 TheVilain profiled[11158] : (Note ) MC: Attempting to retrieve issued certificate...
Aug 1 09:00:56 TheVilain profiled[11158] : (Note ) MC: Could not retrieve issued certificate: NSError:
Desc : Le serveur SCEP a renvoyé une réponse non valide.
US Desc: The SCEP server returned an invalid response.
Domain : MCSCEPErrorDomain
Code : 22013
Type : MCFatalError
Aug 1 09:00:56 TheVilain profiled[11158] : (Error) MC: Cannot retrieve SCEP identity: NSError:
Desc : Le serveur SCEP a renvoyé une réponse non valide.
US Desc: The SCEP server returned an invalid response.
Domain : MCSCEPErrorDomain
Code : 22013
Type : MCFatalError
Aug 1 09:00:56 TheVilain profiled[11158] : (Error) MC: Failure occurred while retrieving profile during OTA Profile Enrollment: NSError:
Desc : Le serveur SCEP a renvoyé une réponse non valide.
US Desc: The SCEP server returned an invalid response.
Domain : MCSCEPErrorDomain
Code : 22013
Type : MCFatalError
Aug 1 09:00:56 TheVilain profiled[11158] : (Error) MC: Installation failed. Error: NSError:
Desc : Échec d’installation du profil
Sugg : Le serveur SCEP a renvoyé une réponse non valide.
US Desc: Profile Installation Failed
US Sugg: The SCEP server returned an invalid response.
Domain : MCInstallationErrorDomain
Code : 4001
Type : MCFatalError
...Underlying error:
NSError:
Desc : Le serveur SCEP a renvoyé une réponse non valide.
US Desc: The SCEP server returned an invalid response.
Domain : MCSCEPErrorDomain
Code : 22013
Type : MCFatalError
Extra info:
{
isPrimary = 1;
}

For the sake of time saving, I generated my own certificates (CA, SLL and RA) thanks to http://www.perturb.org/display/754_Apache_self_signed_certificate_HOWTO.html
Do you have any idea what's going on?

Thanks in advance,
Chris

[jeremybdk]

I am also running into that same issue... Did anyone used this app to successfully enroll a phone ?

Thanks a lot,

[jamesdaniels]

I'll take a peak at this, probably just missing something the newer OS wants. I have working enrollment code in a another project, sorry I haven't had the time to work on this much lately.

[jeremybdk]

Thanks for your answer ! I followed Chris' link for the certificate so it might be the issue but not sure ....
Anyway thanks for your fast answer and support ! At least your code is clear enough to understand but I can't see what's missing or what's causing the error ...

[chrsvl]

@jamesdaniels thanks a lot, it would really help because I'm completely stuck. I've been trying to study Apple's code on OS X Server but I cannot find the solution.

[jeremybdk]

Hello James,
Did you had time to take a look at your code ?

Thanks a lot,

Jeremy

[chrsvl]

I ended up using https://github.com/micromdm/scep. Although it's written in Go, it works like a charm.