iOS 11.3.1 updates not Caching

[willjac037]

Since iOS 11.3.1 was released, updates are not caching to the MacOS server app on 10.12.6 or on 10.13.4 is the caching service.

This appears to be due to the url that the updates has changed domains from

"appldnld.apple.com" to "updates-http.cdn-apple.com" and this is not whitelisted in the Server app.

example from log

2018-04-26 17:23:07.431 #SudsCaLQ8/oL Request by "itunesstored/1.0" for http://192.168.74.155:49468/2018/ios/091-78097-20180419-1837C44A-4063-11E8-A17C-2CE0FBE594B0/com_apple_MobileAsset_SoftwareUpdate/348080d1ecd8fcb42ee21a48be506d66248db38a.zip?source=updates-http.cdn-apple.com denied because the source is not whitelisted
2018-04-26 17:23:07.431 #SudsCaLQ8/oL Failed with status code 400, reason code 66

I have logged this with Enterprise Support case:100519636930 who have been able to replicate the issue also.

[mbeckett]

I've been completely unable to Restore or Update devices to 11.3.1 on any of our Configurator machines, even when bypassing our caching servers by connecting to an outside network. I get the error, "The OS restore image is invalid".

Updates through iTunes work as expected.

Related?

[Sandy]

There is a reported issue, iOS11.3.1 and later, fails to download when Content Caching is enabled on the network. To identify the issue, you will see “iOS cannot be restored on “iPad”. The OS restore image is invalid [ConfigurationUtilityKit.error - 0x2BD (701)]”

I have Content Caching enabled (of course) and was able to get around this in Apple Configurator 2.
Browse to folder: ~/Library/GroupContainers/K36BKF7T3D.group.com.apple.configurator/Library/Caches/Downloads/ACUDownloadFileOperation/

In AC2, click the Update button, I am choosing iOS Only
As soon as the update starts to download, delete the file that appears in that folder (For me it is named: iPad_64bit_TouchID_ASTC_11.3.1_15E302_Restore.ipsw )
I'm not sure what hoodoo is going on but deleting that file during the download allowed the iPads to be updated.

Apple's response
Current workaround for the issue is:

— iTunes 12.7.4 is able to perform restores of devices to iOS 11.3.1 without incident with Content Caching enabled. — If the IPSW file is pulled from the iTunes Software Update location and copied to the Configurator Group Container (~/Library/Group Containers/K36BKF7T3D.group.com.apple.configurator/Library/Caches/Firmware/), restores using Configurator are successful with Content Caching enabled.

but I have found that utilizing of iTunes for this is so painful due to the required Activation, trusting etc...

[Dylan_YYC]

Oh... so there is an issue! i tried getting Apple Configurator to work for an hour and my google skills let me down, i didn't know about this! I eventually gave up and let iTunes do its thing. Thanks for posting!

[mbeckett]

Thanks for the confirmation, Sandy. Like Dylan, my Google-fu wasn't up to the challenge, apparently.

Unfortunately, I'm not having the luck you're having. With the deleting-while-downloading trick, I'm getting the OS restore image error message as soon as the file is created, at 0K; no time to delete it.

And despite my best attempts, copying the iTunes derived IPSW to the Firmware folder is not allowing for restoration.

Here's hoping Apple fixes this quickly. In the meantime, I'm just preparing devices, and then using Jamf Pro to push out an iOS update command instead.

[CGundersen]

You should be able to just dl (I used dev account) the correct IPSW and drag onto selected devices in Configurator2. Had to go that route Thursday. We no longer have Apple Enterprise support, but called general support line to report earlier today.

[cambalam372]

Also seeing this issue with iOS App deployment. macOS app deployment seems to be unscathed.

[mbeckett]

Thanks CGundersen, that does work! I wasn't aware of this drag and drop functionality.

[rwrattan]

Apple told us this is a known issue, below is what I sent to our techs:

Workaround 1 (Takes a lot longer to restore)
1. Update/Restore via iTunes as it seems it is not affected by this behavior. This process takes a long time, so I recommend the second workaround below.

Workaround 2 (Recommended)
2. Grab the IPSW files from https://ipsw.me/ and download it and then copy it to Apple Configurator’s Group Container directory. It’s extremely important that the names of these files are not changes as AC2 will not like it and give you an error.

To get to this directory click on Finder and hold at the same time Command +Shift +G (Or Finder -> Go -> Go To Folder) and paste this path below and select enter.
~/Library/Group Containers/K36BKF7T3D.group.com.apple.configurator/Library/Caches/Firmware/

Once copied to that folder you can continue to use AC2 to restore/update/prepare devices as you please.

Note: The shared link should contain IPSW files for all models eligible to go to iOS 11.3.1. If you need to update a different model not covered by these IPSW files, you’ll need to first update or restore via iTunes then click on Finder and hold at the same time Command +Shift +G and paste this path below:
~/Library/iTunes/iPad Software Updates
Grab the IPSW file for that model and paste it into the Apple Configurator Group Container Directory for each device type/model as it may use a different build of 11.3.1.

I provided them with a link to the direct IPSW files so they didn't have to download them.

[Quentin25]

Hello

Some news about this issue ?

I need to deploy 500 iPads and to update it's complicated without caching update..

Thanks.

Have a nice day !

[Dylan_YYC]

Seems they have! i was able to do a few with AC2 with no issues.

[willjac037 · Accepted solution]

Yes, Apple Enterprise Support have confirmed they have added the two new URLS as whitelisted addresses in the caching service registration file

http://suconfig.apple.com/resource/registration/v1/config.plist