我对创建 PushCertWebRequest 很感兴趣（这来自苹果文档）
我找到了很多文档如何为 Air-watch 等第三方供应商执行此操作，但他们跳过了使用 .p12 证书的最后一步。我的意思是当您应该创建 PushCertWebRequest 并将其上传到 https://identity.apple.com/pushcert
所以我的问题是如何创建推送证书请求 plist。
这个plist的例子应该如下（这是来自苹果文档）
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PushCertRequestCSR</key>
<string>
MIIDjzCCAncCAQAwDzENMAsGA1UEAwwEdGVzdDCCASIwDQYJKoZIhvcNAQEBBQAD
</string>
<key>PushCertCertificateChain</key>
<string>
-----BEGIN CERTIFICATE-----
MIIDkzCCAnugAwIBAgIIQcQgtHQb9wwwDQYJKoZIhvcNAQEFBQAwUjEaMBgGA1UE
AwwRU0FDSSBUZXN0IFJvb3QgQ0ExEjAQBgNVBAsMCUFwcGxlIElTVDETMBEGA1UE
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDlTCCAn2gAwIBAgIIBInl9fQbaAkwDQYJKoZIhvcNAQEFBQAwXDEkMCIGA1UE
AwwbU0FDSSBUZXN0IEludGVybWVkaWF0ZSBDQSAxMRIwEAYDVQQLDAlBcHBsZSBJ
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDpjCCAo6gAwIBAgIIKRyFYgyyFPgwDQYJKoZIhvcNAQEFBQAwXDEkMCIGA1UE
AwwbU0FDSSBUZXN0IEludGVybWVkaWF0ZSBDQSAxMRIwEAYDVQQLDAlBcHBsZSBJ
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDiTCCAnGgAwIBAgIIdv/cjbnBgEgwDQYJKoZIhvcNAQEFBQAwUjEaMBgGA1UE
AwwRU0FDSSBUZXN0IFJvb3QgQ0ExEjAQBgNVBAsMCUFwcGxlIElTVDETMBEGA1UE
-----END CERTIFICATE-----
</string>
<key>PushCertSignature</key>
<string>
CGt6QWuixaO0PIBc9dr2kJpFBE1BZx2D8L0XH0Mtc/DePGJOjrM2W/IBFY0AVhhEx
</string>
最后我创建了PushCertRequestCSR和PushCertSignature，但我真的不知道如何创建PushCertCertificateChain块。
I'm interesting in creation of PushCertWebRequest (this is from apple documentation)
I have found a lot of docs how to do this for 3rd party vendors like Air-watch and so on, but they skip last step where they are working with your .p12 certificate. I mean process when you should create PushCertWebRequest and upload it to https://identity.apple.com/pushcert
So my question is how to create a Push Certificate Request plist.
the example of this plist should be following (this is from apple doc)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PushCertRequestCSR</key>
<string>
MIIDjzCCAncCAQAwDzENMAsGA1UEAwwEdGVzdDCCASIwDQYJKoZIhvcNAQEBBQAD
</string>
<key>PushCertCertificateChain</key>
<string>
-----BEGIN CERTIFICATE-----
MIIDkzCCAnugAwIBAgIIQcQgtHQb9wwwDQYJKoZIhvcNAQEFBQAwUjEaMBgGA1UE
AwwRU0FDSSBUZXN0IFJvb3QgQ0ExEjAQBgNVBAsMCUFwcGxlIElTVDETMBEGA1UE
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDlTCCAn2gAwIBAgIIBInl9fQbaAkwDQYJKoZIhvcNAQEFBQAwXDEkMCIGA1UE
AwwbU0FDSSBUZXN0IEludGVybWVkaWF0ZSBDQSAxMRIwEAYDVQQLDAlBcHBsZSBJ
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDpjCCAo6gAwIBAgIIKRyFYgyyFPgwDQYJKoZIhvcNAQEFBQAwXDEkMCIGA1UE
AwwbU0FDSSBUZXN0IEludGVybWVkaWF0ZSBDQSAxMRIwEAYDVQQLDAlBcHBsZSBJ
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDiTCCAnGgAwIBAgIIdv/cjbnBgEgwDQYJKoZIhvcNAQEFBQAwUjEaMBgGA1UE
AwwRU0FDSSBUZXN0IFJvb3QgQ0ExEjAQBgNVBAsMCUFwcGxlIElTVDETMBEGA1UE
-----END CERTIFICATE-----
</string>
<key>PushCertSignature</key>
<string>
CGt6QWuixaO0PIBc9dr2kJpFBE1BZx2D8L0XH0Mtc/DePGJOjrM2W/IBFY0AVhhEx
</string>
Finally I created PushCertRequestCSR and PushCertSignature, but I don't really know how to create PushCertCertificateChain block.
发布评论
评论（3）
请参阅此处的详细步骤和源代码来生成plist。
Please see detailed steps and source code here to generate plist.
我将 softhinker java 代码移植到 python 中，并添加了一些不错的东西。它可以在 GitHub 上找到：http://www.github.com/grinich/mdmvendorsign。
I ported the softhinker java code to python, and added a few nice things. It's available on GitHub: http://www.github.com/grinich/mdmvendorsign.
使用任何工具包创建 CSR，即 Mac 系统上的 KeyChain Access，
然后将私钥导出为“vendor.p12”
登录Apple会员中心，然后转到“iOS配置门户”
选择左侧导航栏的“证书”，然后点击“其他”
中心选项卡。
按照该页面上的说明操作，并上传您创建的 CSR。
那么您作为 MDM 供应商的证书将可供以下用户使用
在“其他”选项卡上下载。然后下载它。
下载 WWDR 中间证书。
下载Apple根证书。
执行以下 openssl 命令以转换 MDM 供应商证书、WWDR
证书、苹果根证书转PEM格式一一：
openssl x509 -inform der -in mdm_identity.cer -out mdm.pem
openssl x509 -inform der -in AppleWWDRCA.cer -out middle.pem
openssl x509 -inform der -in AppleIncRootCertificate.cer -out root.pem
然后使用softthinker 网页生成编码的 plist。
您需要将 java 包中的占位符替换为您自己的占位符，因为 java 包上提供的只是示例一个（零大小），其中：
customer.der、vendor.p12、mdm.pem、intermediate.pem、root。 pem
现在首先验证生成的 plist.xml 格式应与 MDM 协议参考文档中提供的示例 plist.xml 匹配。
如果 plist.xml 的格式合适，则将encoded_plist上传到门户。所以我们需要注意plist.xml仅供我们参考，不适用于上传。仅用于上传encoded_plist。
之后，从 门户 下载证书。
create a CSR using any toolkit, i.e. KeyChain Access on Mac System,
then export private key as 'vendor.p12'
log in to Apple Member Center, and go to 'iOS Provisioning Portal'
select 'Certificates' on the left navigation bar, and click 'Other'
tab on the center.
follow the instruction on that page, and upload the CSR you created.
then the certificate for you as a MDM vendor will be available to
download on the 'Other' tab. And download it.
download WWDR intermediate certificate.
download Apple root certificate.
execute below openssl command to convert MDM vendor certificate, WWDR
certificate, and Apple root certificate to PEM format one by one :
openssl x509 -inform der -in mdm_identity.cer -out mdm.pem
openssl x509 -inform der -in AppleWWDRCA.cer -out intermediate.pem
openssl x509 -inform der -in AppleIncRootCertificate.cer -out root.pem
Then use the attached Java program in the softthinker webpage to generate encoded plist.
You need to replace the placeholder in the java package with your own ones because the provided on the java package is just sample one(zero size) which are:
customer.der, vendor.p12, mdm.pem, intermediate.pem, root.pem
Now first verify the generated plist.xml format that should match with the sample plist.xml provided in MDM Protocol Reference document.
If plist.xml is in appropriate format then upload the encoded_plist to portal . So we need to take care that plist.xml is just for our reference this is not for upload.For upload encoded_plist only.
After that download the certificate from portal.