MAC Server and Profile Manager issues (SSL errors?)

Delvis · 25 Sep 2019 at 16:30

Hi all,

We've recently upgraded our clients to Mojave, but since then we can not enrol the clients with our server (which is on Yosemite)

We can download the profile and install that certificate, but when we download certificate (Remote management?) it fails during install stating:

"An SSL error has occurred and a secure connection to the server cannot be made"

Our certificates as far as I am aware have been renewed, is there something else that needs doing?

Delvis · 25 Sep 2019 at 22:18

ChrisD. said:
I’d imagine you’d have to update the Server OS as well.

Would you be able to point to anything saying that?

The clients where on Sierra, server on Yosemite with no issues so not sure why it'd be a pain now? I've tried searching for a compatibility list but can't see anything

Delvis · 25 Sep 2019 at 22:38

ChrisD. said:
I’m going to take a guess that the cipher suite in use by Yosemite isn’t accepted by the newer client OS.

I read something similar but couldn't pin point.

So essentially the Mac server needs updating to Mojave?

We use profiles for our clients, issue being we have three that are laptops, if we update the server, will those three stop working or will the profile just not work? (I dont know if it caches the profile each time for instance) - The laptops and clients use Windows authentication for physically logging in by the way.

Delvis · 26 Sep 2019 at 09:18

ChrisD. said:
I’m not too sure, sorry. I’ve never used macOS as a server OS.

No worries at all! Thank you for the input you have given

Delvis · 27 Sep 2019 at 14:40

Re-imaged both clients and the server to Mojave, same flipping issue?????

Can anyone help?

Delvis · 28 Sep 2019 at 10:10

Bizarre.

Ended up trying it on an older machine that hasn't touched that server before and it essentially said 'careful something may be trying to impersonate xServer'.

So, rebuilt the server again to Mojave, gave it an entirely fresh new name, and it worked straight away.

We think, the issue was with the Apple certificate site(?) - Identity.Apple...If we removed the old certificates and waited 24hours+, we may have been able to rebuild the server and carry on with the same hostname. Who knows!