Digital Certificates

Apple devices allow local configurator connection with enrolment with InTune

thescobberLeave a comment

Connecting a device to a computer post InTune MDM enrolment can be challenging due to the necessity of an Apple Configurator certificate. However, obtaining and configuring this certificate isn’t always straightforward.

Unfortunately this must be completed before enrolment, if there is need to manage a device post-enrolment. The user will need to have iCloud storage to perform a backup and restore after a reset. The actual need for this is subjective. However if you are a IT department creating backups locally has a great advantage for user support. As does being able to install ad-hoc profiles or updating the device. The latter two could always be done with the MDM.

Contrary to some online suggestions, this isn’t a push certificate from Apple. The actual process involves:

  1. Procuring the Apple Configurator certificate.
  2. Exporting and configuring it to match InTune’s specific requirements for seamless device connectivity with a computer.

Understanding this precise procedure is essential for successful integration with InTune MDM, ensuring a smooth experience for managing devices.

Choose Login, then the certificates tab, and Choose the certificate labelled Apple Configurator.

If you do not see a certificate for Apple Configurator. Ensure you have imported or signed into your organisation through Apple Configurator.

Click File / Export Items

Choose a filename and path and change the file format to Certificate (.cer)

Open Intune and navigate to

Devices | iOS/iPadOS | Enrolment | Enrolment Program Tokens | Profiles | Profile Name

Choose Sync With Computers: Allow Apple Configurator by Certificate

Choose the certificate file that you have exported and save

Any newly enrolled devices from this point onwards, will be allowed to connect to Apple Configurator with your management computer. If you want to use it on another PC, importing the organisation should be enough.

Excel VBA Signing

thescobberLeave a comment

Today I experienced a strange issue signing Excel VBA code.

Problem

From the VBA editor, when you choose your certificate through Tools\Digital Signature. Ecel would complain about not having any valid signing certificates. However there was one issued by our corporate PKI.

Cause

The cause of this problem, was due to the fact that Windows had two entries in the personal certificate store (certmgr.msc). One of the entries was the Public Key only. The other was the Public + Private key bundle.

Excel must during its certificate enumeration process read the Public Key only certificate. Determine it has no private key, then move onto the key bundle and determine that the public component is the same as what was already evaluated as invalid for signing.

This issue can occur by importing all the certificates provided in the .zip from your nominated registrar. You should only ever need to import the single certificate that contains the Public and Private keys. You should not need to install the Root certificate that comes with your certificate bundle. If you paid for a trusted certificate then it should already be trusted by Windows.

Resolution

Delete any certificates entries that do not contain a private key and share the same public key information as your code signing certificate.