XenMobile - Enrollment failing on devices running iOS 27
Article ID: CTX697069
Updated On:
Description
When XenMobile Server is configured behind NetScaler ADC with SSL offload, the ADC terminated the TLS connection from the device for MDM enrollment traffic.
iOS has introduced a change in TLS stack that requires Extended Master Secret ((EMS), TLS extension during the TLS 1.2 handshake.
If EMS is not enabled on ADC, TLS handshake does not negotiate EMS. As a result, the IOS mdmclient aborts the enrollment process and Secure Hub reports
“Profile Installation Failed - An Unknown Error Occurred.”
EMS Support is available in NetScaler ADC and can be enabled through an SSL profile.
Environment
Binding an SSL profile resets the existing SSL Parameters and Protocols. So the new SSL Profile must preserve every required existing setting, especially the non-default ones. For more information about SSL profiles, see SSL profiles | NetScaler 14.1
Also, unbinding the SSL profile does not automatically restore the previous SSL Parameters and Protocols. We strongly recommend backing up the ADC configuration before adding SSL profiles. To do this, go to System > Diagnostics and click Save configuration under Maintenance, and rename the backup file to prevent it from being overwritten by future backups. If applicable, also take a snapshot of the ADC VM. If restoration is needed, you can use the backup file or revert to the snapshot.
For ADC 14.1.x, it is more convenient to use SSL Migration tool provided by ADC to migrate the SSL configuration; however, the tool is not supported by ADC 13.1.x.
Cause
What changed in iOS 27
iOS 27 changed Apple’s TLS stack for MDM enrollment. During the TLS 1.2 handshake, enrollment now requires Extended Master Secret (EMS, RFC 7627).
Why EMS is required
EMS is a TLS extension that binds the session master secret to the full handshake transcript. This strengthens the handshake and helps protect against triple-handshake and man-in-the-middle attacks.
Impact when EMS is not negotiated
- If the server side does not negotiate EMS, the iOS 27 mdmclient aborts the enrollment.
- Secure Hub then displays the error message: “Profile Installation Failed – An Unknown Error Occurred.”
Resolution
When ADC for XenMobile Server is configured in SSL offload mode, the ADC terminates device-facing TLS for MDM enrollment and related traffic. Therefore, EMS must be enabled on the ADC.
Extended Master Secret (EMS) is an optional extension to the Transport Layer Security (TLS) protocol. This parameter was introduced in ADC release 13.0 build 61.x and can be enabled only in an SSL profile. For more information, see Support for Extended Master Secret in SSL handshake.
To unblock iOS 27 beta enrollment, add SSL profiles for both MDM Load Balancing (LB) Virtual Servers if they do not already exist, then enable EMS as shown in the example below.
Enable EMS for MDM LB VS (port 443)
Step1: Go to MDM LB VS with port 443
(e.g., XM_LB_MDM_443)
Step2: Migrate existing SSL parameters to SSL Profile
(Skip this step if an SSL Profile is already bound to the MDM LB Virtual Server)
Before adding a new SSL Profile, back up the ADC configuration (as described in “Disclaimer”), and save a snapshot of the existing SSL Parameters and Protocols.
You can manually add an SSL Profile and apply the customized settings from the existing SSL Parameters and Protocols of MDM LB (port 443), including “Enable DH Param”, “Client Authentication”, “SSL Redirect” etc.
For more information, see Set SSL profile parameters by using the CLI and Set SSL profile parameters by using the GUI. Contact the ADC support team if there are any questions during the migration.
The following example shows how to manually add an SSL Profile in the GUI:
Select “SSL Profile” in Advanced Settings and click “Add”
Step3: Enable EMS in SSL Profile for iOS 27 enrollment
Select “YES” for “Allow Extended Master Secret” (Key for iOS 27 enrollment)
For more information, see Enable EMS using the CLI and Enable EMS using the GUI.
Step4: Bind SSL Profile and Save running configuration
Review the configuration and click “Done” to save, and then click “OK” to bind the SSL Profile to the MDM LB Virtual Server (port 443)
Click the disk label in the upper-right corner to save the running configuration.
Enable EMS for MDM LB VS (port 8443)
Step1: Go to MDM LB VS with port 8443
(e.g., XM_LB_MDM_8443)
Step2: Migrate existing SSL parameters to SSL Profile
(Skip this step if an SSL Profile is already bound to the MDM LB Virtual Server)
Before adding a new SSL Profile, back up the ADC configuration (as described in “Disclaimer”) and save a snapshot of the existing SSL Parameters and Protocols.
You can manually add an SSL Profile and apply the customized settings from the existing SSL Parameters and Protocols of MDM LB (port 8443), including “Enable DH Param”, “Enable Session Reuse" etc.
For more information, see Set SSL profile parameters by using the CLI and Set SSL profile parameters by using the GUI. Contact the ADC support team if there are any questions during the migration.
The following example shows how to manually add an SSL Profile in the GUI:
Select “SSL Profile” in Advanced Settings and click “Add”
Step3: Enable EMS in SSL Profile for iOS 27 enrollment
Select “YES” for “Allow Extended Master Secret” (Key for iOS 27 enrollment)
For more information, see Enable EMS using the CLI and Enable EMS using the GUI.
Step4: Bind SSL Profile and Save running configuration
Review the configuration and click “Done” to save, and then click “OK” to bind the SSL Profile to the MDM LB (port 8443).
Click the disk label in the upper-right corner to save the running configuration.
Issue/Introduction
Enrollment of devices running iOS 27 fails when connecting to on-premises XenMobile Server via NetScaler ADC SSL offload.
Secure Hub displays the following error
"Profile Installation Failed - An Unknown Error Occurred."
This occurs because iOS 27 strictly requires Extended Master Secret ((EMS), TLS extension during the TLS 1.2 handshake, If EMS is not negotiated by the NetScaler ADC, the iOS mdmclient terminates the MDM enrollment.
Additional Information
