Profile Installation Fails with an RSA Key Below 2048 Bits

Description

If Apple device enrollment reaches profile installation and then fails, check the FileWave Server certificate. This article covers the specific case where the certificate uses an RSA key smaller than 2048 bits, an issue first seen when iOS 12 enforced the stronger key-size requirement.

This is one certificate-specific cause, not a general fix for every profile installation failure. Confirm the RSA key size before replacing the certificate.

Older self-signed certificates are the most likely case. Check the key size regardless of certificate issuer before deciding whether this article matches the failure.

Directions

Use the command for the FileWave Server platform to inspect the certificate's RSA key size.

macOS, Linux:

openssl x509 -in /usr/local/filewave/certs/server.crt  -text -noout | grep Public-Key

Windows

C:\OpenSSL-Win64\bin\openssl.exe x509 -in C:\ProgramData\FileWave\FWServer\certs\server.crt -text -noout | FINDSTR Public-Key

Windows does not have openssl installed as standard so you will need to go to https://slproweb.com/products/Win32OpenSSL.html and download the appropriate version of OpenSSL for your environment.

If the reported RSA key size is below 2048 bits, replace the server certificate before retrying enrollment.

For a self-signed certificate, either:

• Generate a replacement certificate with an RSA key size of 2048 bits or larger.
• Replace it with a certificate issued by a trusted certificate authority.

Please take into consideration the following KB when moving to a new certificate: Root Trusted SSL Certificate (Using and Renewing)