MDM
Zentral can be used as MDM server for Apple devices.
Push certificates
To be able to send notifications to the devices, Zentral needs a push certificate (aka. APNS certificate). To get one, you first need to generate an MDM vendor certificate. An Apple Developer Enterprise Account with the ability to generate MDM CSRs is required. You can then use this vendor certificate to sign an APNS certificate request. The mdmcerts
Zentral management command can be used to help with this process.
MDM vendor certificate
Run the following command to setup a working directory with a vendor certificate request:
python server/manage.py mdmcerts -d the_working_directory init
- Choose a password for the vendor certificate request private key, and remember it!
The content of the working directory should be the following:
$ ls the_working_directory
vendor.csr vendor.key
- Sign in to the Apple Developer Portal and navigate to Certificates, Identifiers & Profiles.
- Create a new certificate, choose Services > MDM CSR.
- Upload the
vendor.csr
file. - Download the generated certificate and store it as
vendor.crt
in the working directory.
Push/APNS certificate
Run the following command to create an APNS certificate request and sign it with the vendor certificate:
python server/manage.py mdmcerts -d the_working_directory req COUNTRYCODE
- Choose a password for the push/APNS certificate request private key, and remember it!
- Enter the password for the MDM vendor certificate private key.
The content of the working directory should be the following:
$ ls the_working_directory
push.b64 push.csr push.key vendor.crt vendor.csr vendor.key
- Sign in to the Apple Push Certificate Portal.
- To renew an existing certificate, choose the certificate and click the Renew button.
- To create a new certificate, click the Create a Certificate button.
- Upload the
push.b64
signed certificate request. - Download the generated certificate.
Navigate to the Zentral MDM > Push certificates section, and either select an existing certificate and click on the Update button to renew an existing certificate, or click on the Add button to create a new push certificate. Upload the generated certificate, the push.key
private key, and enter the password of the push certificate private key.
Renewing a Push/APNS certificate
IMPORTANT do not let the push/APNS certificates expire! Remember to renew them ahead of their expiry!
To be able to keep sending notifications to enrolled devices, it is important to renew the existing certificates, and not generate new ones (it it important that the topic of a push certificate stays the same). In the Apple Push Certificate Portal, look for the existing certificate and click on the Renew
button, and not on the Create a Certificate
button. In the Zentral MDM > Push certificates section, find the certificate and click on the Update button, and do not Add a new certificate.