Hi everyone!
We recently ran into an issue with our push certificate renewal on our Jamf Pro instance that I wanted to share, along with the workaround we found — in case it helps someone in the same situation.
The problem:
We had renewed our push certificate several times using different Apple accounts instead of the one originally used. This caused the Topic ID in Jamf Pro to no longer match, which broke our ability to send commands to our devices.
It took us a while to notice, and by the time we did, MDM had expired on a large number of our Macs since no commands were getting through anymore.
To make matters worse, we had disabled the ability to manually remove the MDM profile on the machines, so we ended up with a fleet of Macs stuck with an outdated/expired MDM profile that we couldn't remove or replace.
We contacted Jamf support, and the only official solution was to recover the correct Topic ID by renewing the original certificate — but that wasn't possible for us since we no longer had access to that certificate on Apple's push certificate portal. Wiping our entire fleet was not an option either.
The workaround:
Here's what we did to remove the MDM profile without wiping the machines:
- Boot into Recovery Mode
- Open Terminal and disable System Integrity Protection:
csrutil disable - Restart the machine
- Log back into the user session
- Open Terminal and run the following to remove the configuration profiles:
cd /var/db/ConfigurationProfilessudo rm -rf * - Once done, the MDM profile should no longer be installed
- You can now install a new MDM profile
- Don't forget to re-enable SIP by booting back into Recovery Mode and running:
csrutil enable
This was the most efficient fix we found, since re-imaging our entire Mac fleet simply wasn't feasible.
We've also updated our push certificate renewal procedure to make sure we always renew the same certificate through the same Apple account going forward.
Hope this helps someone out there!
