Certificate Handling in CapaInstaller

Before CapaInstaller Mobile Device Management (MDM) can communicate with devices and third-party mobile providers, the data sent back and forth must be protected by signed certificates. MDM uses two kinds of certificates:

• A TLS certificate for the domain where the MDM service is published. It secures the communication between the devices and your MDM service.
• An Apple Push Certificate, which Apple requires before CapaInstaller can contact Apple devices.

Read more:

• Certificate authority (wikipedia.org)
• Transport Layer Security (wikipedia.org)

Recommendations

• Use a certificate that supports at least TLS 1.2.
• Use a certificate signed with SHA-256.
• Use a certificate authority that the manufacturers of your devices trust.

Request a TLS certificate

To secure your MDM communication, you need a certificate issued to the domain where the MDM service is published. If you don’t have a certificate for that domain, request one from a trusted certificate authority. This can take some time, so request it well before you implement MDM.

CapaInstaller MDM supports wildcard certificates.

Create the Apple Push Certificate

You create and renew the Apple Push Certificate with the Apple Push Certificate request wizard in the CapaInstaller Console. Since CapaInstaller 6.1, the wizard uploads the certificate to CapaOne, so you don’t install it on the MDM server. See Apple Push Notification Certificate.

Caution

Every certificate has an expiration date. For example, Apple requires you to renew the Apple Push Certificate every 365 days. Start the renewal in good time before a certificate expires. Without valid certificates, CapaInstaller MDM stops working.

Import a certificate to the Windows Certificate Store

The CapaInstaller services read their TLS certificate from the Personal store of the local computer on the server where the service runs. MDM requires a certificate with a private key, which is always a .pfx file.

To import the .pfx file:

1. On the server where the service runs, right-click the .pfx file and select Install PFX.
2. In the Certificate Import Wizard, select Local Machine as the store location, and click Next.
3. On the File to Import page, click Next.
4. On the Private key protection page, type the password for the private key, and click Next.
5. On the Certificate Store page, select Place all certificates in the following store, select Personal, and click Next.
6. Click Finish.

The certificate appears under Certificates (Local Computer) → Personal → Certificates in certlm.msc. To assign it to a service, see Configuring or Updating a Certificate.

Read more:

• Managing certificates (learn.microsoft.com)
• Import-Certificate: import certificates into a certificate store with PowerShell (learn.microsoft.com)
• Tools to create, view, and manage certificates (learn.microsoft.com)

Remove a previously installed certificate binding

If another certificate is already bound to the port the service uses, you can remove the binding. Open a command prompt as administrator and list the certificate bindings for all ports:

• PowerShell

netsh http show sslcert

To remove the binding for a port, for example port 443, run:

• PowerShell

netsh http delete sslcert ipport=0.0.0.0:443

Note

If a verification step fails, see:

• OpenSSL
• CapaInstaller Network Port Reference