Skip to main content

This one is for all of those wanting to issue the .p12 certificate to computers via Jamf Pro for Google LDAP Authentication with Jamf Connect.

 

I've recently performed an integration for a customer with Jamf Connect and their G-Suite tenant following the article provided here: https://learn.jamf.com/bundle/jamf-connect-documentation-current/page/Integrating_with_Google_Identity.html 
and found that when attempting to issue the certificate via a configuration profile, I would get the error "the certificate could not be verified (authentication error)"

 

I ended up going down a long rabbit hole of troubleshooting that ended with having me attempt to install the certificate manually, which lead me to find that the password I created wasn't being accepted within keychain access.

This lead me to the following article going over an open issue with OpenSSL 3.x and it's deciphering issues:
https://stackoverflow.com/questions/70431528/mac-verification-failed-during-pkcs12-import-wrong-password-azure-devops

 

The solution for me was to append the -legacy flag to the command for creating the .p12 file in order to generate a certificate package that could be accepted on the endpoint. The modification looked like the below code:

openssl pkcs12 -export -legacy -out /path/to/generated/keystore.p12 -inkey /path/to/saved/privatekey.key -in /path/to/saved/certificate.crt

This newly generated Certificate payload was accepted both manually and through the configuration profile immediately.

 

Additional Context:

My testing utilized Jamf Connect 2.28.0 and MacOS 13.6.

Thank you a lot, this was of invaluable help!

Yes!  Saved my bacon!  Had a ticket open with Jamf for the cert issues I was having so hopefully they update the docs with this info soon.

hi


-legacy option is no longer available with openssl version on macOS it seems 


/usr/bin/openssl version


LibreSSL 3.3.6


any idea to make this work now ? 

hi


-legacy option is no longer available with openssl version on macOS it seems 


/usr/bin/openssl version


LibreSSL 3.3.6


any idea to make this work now ? 


Might have to get brew and install openssl@3.0 (v3.0.15) or openssl@3 (v3.4.0)

hi


-legacy option is no longer available with openssl version on macOS it seems 


/usr/bin/openssl version


LibreSSL 3.3.6


any idea to make this work now ? 


This worked for me in 15.3.1. I do have homebrew installed.

I'm experiencing the same issue. Before generating a new .p12 file with the -legacy option, I researched its security implications. It appears that this option can indeed introduce security vulnerabilities. While the -legacy option enhances compatibility with older systems by employing weaker or outdated cryptographic algorithms and methods, I'm unsure if this is a good idea from a security standpoint, especially for a company undergoing SOC, ISO 27001, and internal IT audits.

Reply


Terms & ConditionsCookie settings