java - WSO2 MDM iPhone 配置文件安装问题(无效的 DER 编码，未完结)

Question

我正在为 iPhone MDM 使用 WSO2(3.2.0) IOT 服务器并按照网站上的说明安装它

我生成了 MDM APNS 证书 并将其添加到服务器的 ios 配置中。

在为 MDM 注册 iPhone (iphone 6) 时，我在 iPhone 和 wso2 服务器 (3.2.0) 上遇到配置文件安装失败并发生以下错误，但是配置文件安装在 iphone x 模拟器中运行良好。

我在安装第二个配置文件(用于 MDM 设备身份证书)时遇到此错误

[2018-04-03 17:17:53,672] [IoT-Core] ERROR - {org.wso2.carbon.certificate.mgt.cert.jaxrs.api.impl.CertificateManagementAdminServiceImpl} Error occurred while converting PEM file to X509Certificate.
org.wso2.carbon.certificate.mgt.core.exception.KeystoreException: CertificateException when decoding certificate signature
    at org.wso2.carbon.certificate.mgt.core.impl.CertificateGenerator.extractCertificateFromSignature(CertificateGenerator.java:415)
    at org.wso2.carbon.certificate.mgt.core.service.CertificateManagementServiceImpl.extractCertificateFromSignature(CertificateManagementServiceImpl.java:114)
    at org.wso2.carbon.certificate.mgt.cert.jaxrs.api.impl.CertificateManagementAdminServiceImpl.verifyCertificate(CertificateManagementAdminServiceImpl.java:241)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:188)
    at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:104)
    at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:204)
    at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:101)
    at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:58)
    at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:94)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:272)
    at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
    at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:249)
    at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:248)
    at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:222)
    at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:153)
    at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:171)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:289)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:209)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:650)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:265)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.wso2.carbon.certificate.mgt.cert.jaxrs.api.util.ApiOriginFilter.doFilter(ApiOriginFilter.java:33)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.wso2.carbon.ui.filters.cache.ContentTypeBasedCachePreventionFilter.doFilter(ContentTypeBasedCachePreventionFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:124)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:615)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
    at org.wso2.carbon.tomcat.ext.valves.CompositeValve.continueInvocation(CompositeValve.java:99)
    at org.wso2.carbon.tomcat.ext.valves.CarbonTomcatValve$1.invoke(CarbonTomcatValve.java:47)
    at org.wso2.carbon.webapp.mgt.TenantLazyLoaderValve.invoke(TenantLazyLoaderValve.java:57)
    at org.wso2.carbon.webapp.authenticator.framework.WebappAuthenticationValve.processRequest(WebappAuthenticationValve.java:151)
    at org.wso2.carbon.webapp.authenticator.framework.WebappAuthenticationValve.invoke(WebappAuthenticationValve.java:69)
    at org.wso2.carbon.tomcat.ext.valves.TomcatValveContainer.invokeValves(TomcatValveContainer.java:47)
    at org.wso2.carbon.tomcat.ext.valves.CompositeValve.invoke(CompositeValve.java:62)
    at org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.invoke(CarbonStuckThreadDetectionValve.java:159)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)
    at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:57)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1115)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1770)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1729)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)
Caused by: java.security.cert.CertificateParsingException: java.io.IOException: ObjectIdentifier() -- Invalid DER encoding, not ended
    at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:169)
    at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1804)
    at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195)
    at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:102)
    at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339)
    at org.wso2.carbon.certificate.mgt.core.impl.CertificateGenerator.extractCertificateFromSignature(CertificateGenerator.java:395)
    ... 62 more
Caused by: java.io.IOException: ObjectIdentifier() -- Invalid DER encoding, not ended
    at sun.security.util.ObjectIdentifier.check(ObjectIdentifier.java:611)
    at sun.security.util.ObjectIdentifier.<init>(ObjectIdentifier.java:266)
    at sun.security.util.DerInputStream.getOID(DerInputStream.java:315)
    at sun.security.x509.AVA.<init>(AVA.java:602)
    at sun.security.x509.RDN.<init>(RDN.java:245)
    at sun.security.x509.X500Name.parseDER(X500Name.java:802)
    at sun.security.x509.X500Name.<init>(X500Name.java:306)
    at sun.security.x509.X509CertInfo.parse(X509CertInfo.java:659)
    at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:167)

我最终合并的 .pem 文件如下所示。

-----BEGIN CERTIFICATE-----
//encoded string
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
//encoded string
-----END RSA PRIVATE KEY-----

Answer 1

我们使用最新版本的服务器(即 wso2 iot 服务器 3.3.0)和适用于 ios (3.3.0) 的最新 p2-repo 解决了这个问题。

我们发现，无论您的 wso2 服务器是什么版本，wso2 总是会向您邮寄 3.1.0 版的 ios p2-repo，其中包含上述错误。我们使用最新的服务器(wso2 iot 3.3.0)切换到 3.3.0 p2-repo，问题得到解决