CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-08-10 10:30:33 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
seed_OS_27_0
apple_device-management/mdm/profiles/com.apple.security.acme.yaml
T
Cyrus Daboo 97a11a861f Seed2
2026-06-22 15:55:19 -04:00

240 lines
10 KiB
YAML
Raw Permalink Blame History

title: ACME Certificate
description: The payload that configures Automated Certificate Management Environment
(ACME) settings.
payload:
payloadtype: com.apple.security.acme
supportedOS:
iOS:
introduced: '16.0'
multiple: true
supervised: false
allowmanualinstall: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '13.1'
multiple: true
devicechannel: true
userchannel: true
supervised: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: '16.0'
multiple: true
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '9.0'
multiple: true
supervised: false
allowmanualinstall: true
payloadkeys:
- key: DirectoryURL
title: ACME directory URL
type: <string>
presence: required
content: The directory URL of the ACME server. The URL must use the https scheme.
- key: ClientIdentifier
title: Client identifier
type: <string>
presence: required
content: A unique string identifying a specific device. The server may use this
as an anti-replay code to prevent issuing multiple certificates. This identifier
also indicates to the ACME server that the device has access to a valid client
identifier issued by the enterprise infrastructure. This can help the ACME server
determine whether to trust the device. Though this is a relatively weak indication
because of the risk that an attacker can intercept the client identifier.
- key: KeySize
title: Key size
type: <integer>
presence: required
content: The valid values for `KeySize` depend on the values of `KeyType` and `HardwareBound`.
See those keys for specific requirements.
- key: KeyType
title: Key type
type: <string>
presence: required
rangelist:
- RSA
- ECSECPrimeRandom
content: |-
The type of key pair to generate. Allowed values:
- `RSA`: Specifies an RSA key pair. RSA key pairs need to have a `KeySize` that's a multiple of 8 in the range of 1024 through 4096 (inclusive), and `HardwareBound` needs to be `false`.
- `ECSECPrimeRandom`: Specifies a key pair on the P-192, P-256, P-384, or P-521 curves as defined in FIPS Pub 186-4. `KeySize` defines the particular curve, which needs to be `192`, `256`, `384`, or `521`. Hardware bound keys only support values of `256` and `384`.
> Note:
> The key size is `521`, not `512`, even though the other key sizes are multiples of 64.
- key: HardwareBound
title: Hardware bound
type: <boolean>
presence: required
content: |-
If `false`, the private key isn't bound to the device.
If `true`, the private key is bound to the device. The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key. This prevents the system from exporting the private key.
If `true`, `KeyType` must be `ECSECPrimeRandom` and `KeySize` must be 256 or 384.
macOS 14 on Apple silicon and Intel devices that have a T2 chip support setting this key to `true`. Older macOS versions or other Mac devices require this key but it must have a value of `false`.
- key: Subject
title: Subject
type: <array>
presence: required
content: |-
The device requests this subject for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues.
The representation of a X.500 name represented as an array of OID and value. For example, `/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar` corresponds to:
`[ [ ["C", "US"] ], [ ["O", "Apple Inc."] ], ..., [ [ "1.2.5.3", "bar" ] ] ]`
Dotted numbers can represent OIDs , with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).
subkeys:
- key: ACMESubjectArrayInnerArray
title: Array inside ACME subject array
type: <array>
subkeys:
- key: ACMESubjectArrayPair
title: Subject array pair
type: <array>
subkeys:
- key: ACMESubjectArrayPairItem
title: ACME subject array pair item
type: <string>
repetition:
min: 2
max: 2
- key: SubjectAltName
title: Subject alt name
type: <dictionary>
presence: optional
content: The Subject Alt Name that the device requests for the certificate that
the ACME server issues. The ACME server may override or ignore this field in the
certificate it issues.
subkeys:
- key: rfc822Name
title: RFC 822 name
type: <string>
presence: optional
content: The RFC 822 (email address) string.
- key: dNSName
title: DNS name
type: <string>
presence: optional
content: The DNS name.
- key: uniformResourceIdentifier
title: URI
type: <string>
presence: optional
content: The Uniform Resource Identifier.
- key: ntPrincipalName
title: NT principal name
type: <string>
presence: optional
content: The NT principal name. Use an other name OID set to `1.3.6.1.4.1.311.20.2.3`.
- key: UsageFlags
title: Key usage
type: <integer>
presence: optional
content: |-
This value is a bit field.
- Bit `0x01` indicates digital signature.
- Bit `0x04` indicates encryption.
The device requests this key for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues.
- key: ExtendedKeyUsage
title: Extended key usage
type: <array>
presence: optional
content: |-
The value is an array of strings. Each string is an OID in dotted notation. For instance, `["1.3.6.1.5.5.7.3.2", "1.3.6.1.5.5.7.3.4"]` indicates client authentication and email protection.
The device requests this field for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues.
subkeys:
- key: OID
type: <string>
presence: optional
- key: Attest
title: Attest
supportedOS:
watchOS:
introduced: '10.0'
type: <boolean>
presence: optional
default: false
content: |-
If `true`, the device provides attestations that describe the device and the generated key to the ACME server. The server can use the attestations as strong evidence that the key is bound to the device, and that the device has properties listed in the attestation. The server can use that as part of a trust score to decide whether to issue the requested certificate.
When `Attest` is `true`, `HardwareBound` also needs to be `true`.
macOS 14 supports setting this key to `true`. Older macOS versions require this key but it must have a value of `false`. See below for hardware requirements.
- key: KeyIsExtractable
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
content: If `false`, the device tags the private key of the identity obtained through
Automated Certificate Management Environment (ACME) as "non-extractable" in the
keychain.
- key: AllowAllAppsAccess
title: Allow all apps access
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If `true`, all apps have access to the private key.
notes:
- title: ''
content: |-
Use this payload to specify how the device requests a client certificate from an Automated Certificate Management Environment (ACME) server. Other payloads can reference the resulting client identity by the payload's `PayloadUUID`.
First the device generates an asymmetric key pair based upon the `KeyType`, `KeySize`, and `HardwareBound` fields. Then the device communicates with the ACME server. It requests a new order using the `ClientIdentifier` as the `permanent-identifier`. The ACME server responds with a challenge type of `device-attest-01`. If `Attest` is `true` the device requests an attestation of the key and device properties. Then it replies to the challenge with a WebAuthn attestation statement, and this contains the attestation if the device obtained one. The device submits a certificate signing request matching the key and containing the `ClientIdentifier`, `Subject`, `SubjectAltName`, `UsageFlags`, and `ExtendedKeyUsage` fields. The ACME server issues a certificate, and the device stores the resulting identity.
For details on the content of the attestation provided to the ACME server, see the documentation of the `DevicePropertiesAttestation` key in the `QueryResponses`response. In the attestation certificate the value of the freshness code OID is the SHA-256 hash of the `token` from the `device-attest-01` challenge.
- title: ACME attestation hardware support
content: |-
The following table indicates which System on Chips (SoCs) support ACME attestation.
If the Attest key is false or ignored, the ACME server does not receive an attestation.
| Attest key support | iPhone, iPad | Mac | Apple TV | Apple Watch | Vision Pro |
|--------------------|--------------------------------------|----------------|-------------------------|----------------|------------|
| Must be false | none | T1 and earlier | none | none | none |
| Ignored | A10x Fusion and earlier | T2 | A10x Fusion and earlier | S3 and earlier | none |
| Supported | A11 Bionic and later<br>All M series | Apple silicon | A12 Bionic and later | S4 and later | All |
examples:
- title: Example profile
files:
- file: examples/mdm/profiles/com.apple.security.acme/example1.plist
Reference in New Issue View Git Blame Copy Permalink