https://wiki.open-xchange.com/wiki/index.php?action=history&feed=atom&title=AppSuite%3APList_signing
AppSuite:PList signing - Revision history
2026-09-24T09:29:06Z
Revision history for this page on the wiki
MediaWiki 1.39.7
https://wiki.open-xchange.com/wiki/index.php?title=AppSuite:PList_signing&diff=21411&oldid=prev
Jan.bauerdick: Created PList_signing page
2016-02-10T08:25:48Z
<p>Created PList_signing page</p>
<p><b>New page</b></p><div>= Sign profile files generated by client-onboarding =<br />
<br />
Client-onboarding generates profile files for Mac OS and iOS to configure accounts on an Apple device. By default these profile files are unsigned, which leads to a warning. This page describes how to configure signing those profile files.<br />
<br />
== Requirements ==<br />
<br />
* '''openjdk-7-jre-headless'''<br />
* '''openssl'''<br />
* A valid X.509 certificate and private key (both PEM-encoded)<br />
<br />
== Create keystore ==<br />
<br />
First copy private key and certificate into one file<br />
$ cat example-key.pem example.crt > example.pem<br />
<br />
Then export certificate and key in PKCS#12 format<br />
$ openssl pkcs12 -export -in example.pem -out /path/readable/for/open-xchange/example.p12 -name example<br />
This exports private key and certificate in a password-protected keystore.<br />
<br />
Verify export into keystore was successful<br />
$ keytool -v -list -storetype pkcs12 -keystore example.p12<br />
Output should look like this:<br />
Keystore type: PKCS12<br />
Keystore provider: SunJSSE<br />
<br />
Your keystore contains 1 entry<br />
<br />
Alias name: example<br />
Creation date: Feb 9, 2016<br />
Entry type: PrivateKeyEntry<br />
Certificate chain length: 1<br />
Certificate[1]:<br />
Owner: EMAILADDRESS=root@example.org, CN=example.org, O=Internet Widgits Pty Ltd, ST=Some-State, C=DE<br />
Issuer: EMAILADDRESS=root@example.org, CN=example.org, O=Internet Widgits Pty Ltd, ST=Some-State, C=DE<br />
Serial number: e73ec5a60dcdbe36<br />
Valid from: Mon Nov 30 09:36:38 CET 2015 until: Tue Nov 29 09:36:38 CET 2016<br />
Certificate fingerprints:<br />
MD5: 0D:2E:F0:0B:55:77:3E:5A:76:2C:C6:29:27:F1:61:13<br />
SHA1: 3B:80:59:43:82:27:91:68:96:C4:D5:20:0B:86:C1:45:32:C0:36:8B<br />
SHA256: 33:33:68:0B:E3:5B:85:93:DB:95:4D:F0:5A:EE:57:7B:FD:70:E2:63:9A:28:CC:74:0E:C6:B7:03:DC:BE:7D:92<br />
Signature algorithm name: SHA256withRSA<br />
Version: 1<br />
<br />
<br />
*******************************************<br />
*******************************************<br />
<br />
== Configuration ==<br />
<br />
Open '''/opt/open-xchange/etc/client-onboarding.properties''' and apply following changes:<br />
com.openexchange.client.onboarding.plist.signature.enabled=true<br />
com.openexchange.client.onboarding.plist.pkcs12store.filename=/path/readable/for/open-xchange/example.p12<br />
com.openexchange.client.onboarding.plist.pkcs12store.password=PASSWORD_CHOSEN_AFTER_EXPORT<br />
com.openexchange.client.onboarding.plist.signkey.alias=example<br />
<br />
Property '''com.openexchange.client.onboarding.plist.signkey.alias''' can be overwritten via config-cascade.</div>
Jan.bauerdick