I’m sure I’m doing something obviously wrong when setting up MDM. I’m getting

Failed to start: validate Apple APNs certificate and key: Apple MDM APNs configuration: parse key pair: tls: failed to find any PEM data in certificate input

My fleet.service file has these environment variables set

Environment="FLEET_MDM_APPLE_APNS_CERT_BYTES=/root/mdm_certs/MDM_ Fleet Device Management Inc_Certificate.pem"
Environment="FLEET_MDM_APPLE_APNS_KEY_BYTES=/root/mdm_certs/fleet-mdm-apple-apns.key"
Environment="FLEET_MDM_APPLE_SCEP_CERT_BYTES=/root/mdm_certs/fleet-mdm-apple-scep.crt"
Environment="FLEET_MDM_APPLE_SCEP_KEY_BYTES=/root/mdm_certs/fleet-mdm-apple-scep.key"

Do you need

FLEET_MDM_APPLE_SCEP_CHALLENGE

? https://fleetdm.com/docs/configuration/fleet-server-configuration#mobile-device-management-mdm

IIRC if they want to use a file location they need to drop

_BYTES

from the end of each of the var names.

@marnin Sarah is correct. Any environment variable that ends in

_BYTES

expects the file's actual content to be passed in, not a path to the file. If you want to pass a file path, just remove the

_BYTES

so that it looks like this:

Environment="FLEET_MDM_APPLE_APNS_CERT=/root/mdm_certs/MDM_ Fleet Device Management Inc_Certificate.pem"
Environment="FLEET_MDM_APPLE_APNS_KEY=/root/mdm_certs/fleet-mdm-apple-apns.key"
Environment="FLEET_MDM_APPLE_SCEP_CERT=/root/mdm_certs/fleet-mdm-apple-scep.crt"
Environment="FLEET_MDM_APPLE_SCEP_KEY=/root/mdm_certs/fleet-mdm-apple-scep.key"

Yes, removing

_BYTES

worked! Thank you, I knew it was something obvious. I didn’t see that documented anywhere but maybe I missed it. @Rachel Perkins I didn’t think I needed

FLEET_MDM_APPLE_SCEP_CHALLENGE

because it wasn’t listed here but after I fixed the

_BYTES

syntax and restarted Fleet I got

Failed to start: setup mdm apple services: scep: missing SCEP challenge

so it is required. Where do I find the secret?

Yay, glad you're well on your way Marnin!

The made up scep secret string should also be documented

FLEET_MDM_APPLE_SCEP_CHALLENGE

is documented here

Yes, that documents what the

FLEET_MDM_APPLE_SCEP_CHALLENGE

is but not how you how you get the it or find it. In this case, you don't get it or find it, you create it. If you look at documentation for

mdm.apple​_scep​_key​_bytes

, it saids

Typically generated via fleetctl generate mdm-apple.

That clue, or something similar is missing for

FLEET_MDM_APPLE_SCEP_CHALLENGE

Sorry for any confusion, @marnin and @Luke Heath - but I already pushed through updates to the docs yesterday, feel free to have a look and suggest any more detail https://github.com/fleetdm/fleet/pull/13112

That was quick. Looks good to me for

_BYTES

@marnin is this better for the SCEP docs? https://github.com/fleetdm/fleet/pull/13141/files

Also looks good!

Thank you, @Rachel Perkins!