.mobileconfig generator

[ameshkov]

We may need a more robust .mobileconfig generator dialog that would allow configuring it.

What could be included:

• Server name: Make the mobileconfig API parameterized and more robust #2358
• Client ID: [Feature request] Device Model in .mobileconfig configuration #2493
• Exclusions: [Feature request] Exclusions in .mobileconfig configuration #2494

[ammnt]

@ameshkov, are you really sure AGH can't sign and encrypt these files? This is implemented on the NextDNS🤫

[ameshkov]

Signing requires a developer certificate, we wouldn't use ours to sign user-generated configuration profiles, this is dangerous.

[ammnt]

@ameshkov, to solve this problem, they somehow encrypt these files - I can send you an example of such a file:

Isn't that gonna help?

[ameshkov]

That's how a signed configuration profile looks like, it's not encryption. And this still does not solve any issues, we can't allow third-parties to sign a configuration profile with our developer certificate.

[ammnt]

That's how a signed configuration profile looks like, it's not encryption. And this still does not solve any issues, we can't allow third-parties to sign a configuration profile with our developer certificate.

Ah, okay... Got it✌️

[ameshkov]

Don't get me wrong, it's just if we sign someone's configuration profile, it would look like it comes from us. But it will point to a DNS server that is not controlled by us. And there is quite a lot of nasty stuff that can be done when you operate a DNS server, we don't want to be responsible for that.

[ammnt]

@ameshkov, please, add bootstrap server address strings for initial resolving. Here is example:

<key>ServerAddresses</key>
				<array>
					<string>2606:4700:4700::1111</string>
					<string>2606:4700:4700::1001</string>
					<string>1.1.1.1</string>
					<string>1.0.0.1</string>
				</array>

Thank you🤗

[ZeroClover]

Signing requires a developer certificate, we wouldn't use ours to sign user-generated configuration profiles, this is dangerous.

@ameshkov AGH can use its own TLS certificate (to use DoH, the user would obviously need to set up a TLS certificate in AGH) to sign mobileconfig, as NextDNS does the same thing.

Screenshot:

[fishermanG]

Any update on this? I already have LE certificates configured under the Encryption Settings but .mobileconfig still remains unsigned.

I had to use OpenSSL smime to sign the file. Not too difficult. Would be heck of a life saver if this auto signing can be implemented in AGH.