Skip to main content

As I am still trying to figure out the basics of Casper and OSX in general I am trying to work through the flow of creating a USB boot stick and the eventual OS image. Having never done any of this before I have taken advice from these forums and others. So far, I have had... moderate success.

Is there documentation somewhere on the best method for creating a restorable image that can be placed on a USB drive to be used for Casper Imaging?

I have used AutoDMG to create a DMG file from latest Yosemite installer. Have then taken the DMG and ran it through AutoCasperNBI, ticking the 'Create A Restorable DMG' option. We are currently running Mountain Lion across the board and ACNBI never finishes, so I ran it on a factory Yosemite machine and it pops out a restorable DMG, as it should. However, imaging with USB created from this continuously prompts that the Casper server it is connected to may not be the true Casper server. It seems to be asking for a certificate of some type? I have watched ACNBI run its process, it appears to grab this from the Casper server that I defined in the initial setup. Has anyone experienced this? Is there a way to make it stop asking? It has to be acknowledge by clicking ok or cancel and stops the build while waiting for an answer. I will grab a screen shot when I can. Again, is there a better way/process for creating the image for the USB?

Re-creating the boot media using Casper Imaging 9.72 appears to have partially resolved the certificate error message. Upon initial launch the certificate message does not pop up, able to image a device as normal.

However, if I quit Imaging and re-launch the application the certificate error message is present and continues to occur upon each subsequent quit and launch. Only first launch works without issue. This applies to boot image created manually as well as using AutoCasperNBI.

@MTurnerFMRCO Have you reached out to JAMF support about this?

I've not seen this behaviour myself, & am struggling to recreate.

Only thought I had was: is your JSS behind a load balancer?

@MTurnerFMRCO Any update from JAMF on this? I cannot recreate the issue at all.

@bentoms JAMF support was also scratching their heads on this one. I just got it to work this past Friday after trying and re-trying numerous tests. See below for steps and what eventually worked.

Letting AutoCasperNBI pull the cert from Casper itself did not seem to work. Was present in keychain, looked good to me.
Exporting the cert from Casper and manually adding it to the keychain myself did not work.

As I am very new to this whole Casper and Mac world, I started looking to our production devices, running ML at this time. I noticed that the devices had a Casper cert as well as an internal cert. I grabbed the internal cert, brought it to the USB boot image device and imported it, making sure to match all settings that were present on a production Mac device.

Then began testing. Casper Imaging 9.72 now launches and connects without issue on each and every launch without server cert error messages.

Not sure if this is normal or not, but without both of these certificates on the USB boot device, I get the server cert error message each time and the builds would not complete.

I am assuming that the AutoCasperNBI tool grabs that Casper cert and applies it, that's what it always looked like after I would restore the image it created. Not sure if anyone has ran into this, perhaps only the Casper cert is required for most people's USB boot media, we needed both.

Now onto a server upgrade and trying to create a Yosemite base image......

Thank you (and everyone that responded) for the help!

@MTurnerFMRCO Actually, makes perfect sense...

I was having a nose at AutoCasperNBI & it's grabbing the JSS's CA cert.. Not the Tomcat cert.

If you add the "internal cert" as an additional cert to AutoCasperNBI... It should work, as in the created image should have the cert trust in there as needed.

Actually, I think this maybe a Casper Imaging issue.

By default, AutoCasperNBI will set Casper Imaging to ignore Invalid certs if a JSS URL is passed to it:

If Casper Imaging is not honouring that, then it's a bug with Casper Imaging.

If a JSS URL is not being entered into AutoCasperNBI then it's still a Casper Imaging but as Casper Imaging will not honour the "allowedInvalidCertificate" key. (FR)

Terms & ConditionsCookie settingsAccessibility statement