We nonetheless have an outdated macOS server with profile supervisor operating, with a website wildcard SSL certificates. After renewing the certificates, I checked that https: was working, and likewise that administration profiles could possibly be downloaded. Nice!

Nonetheless, when establishing a brand new gadget, the gadget says that the certificates is invalid, and won’t set up the profile. Reverting again to the (quickly to be expiring) outdated certificates, every thing works nice.

So, I am at a loss for why that is occurring.

So far as I can inform, the basis for each certs is similar. In truth, the CA which was supplied by Digicert/Geotrust appears to be like to be the identical as final yr’s. I’ve exhausted my fundamental data of “openssl” instructions making an attempt to identify any variations, to no avail.

In testing, I see the identical habits in iOS16, iOS17, iOS18, macOS14, and macOS15. When utilizing the expiring certificates, new gadgets can obtain the profile, however when utilizing the newer certificates, errors happen. Additionally, with the newer certificates, all the above gadgets are capable of set up profiles (manually, from the /mydevices URL).

One attention-grabbing observe, is that yesterday the error was “invalid certificates”; nevertheless, immediately, it simply says “canceled” (iOS16). I learn that ABM was having points in a single day, so this can be associated. However, my bother with new gadgets and the brand new certificates began over per week in the past.

PS – I am not utilizing profile supervisor as a result of I need to. However, be happy so as to add extra the reason why it is a dangerous concept (so long as you attempt to assist clear up the unique downside).