Certificate to be used for encryption in iOS MDM

Question

I am facing issue in encrypting the final configuration profile to be sent to the iOS device(Phase 3).

I am using the Bouncy castle library to encrypt my final profile( http://elian.co.uk/post/2009/07/29/Bouncy-Castle-CSharp.aspx ).

Questions:

1. Which certificate should I use for encrypting the profile, Is it a CA or Server certificate created or Certificate returned after Phase 2(SCEP)?

A code sample would be very helpful.

NOTE: The profile is getting installed successfully without encryption or even if I sign the profile.

Answer 1

On the server side you always

• encrypt using device identity cert (which is generated through SCEP or PKCS12)
• sign using Server certificate

Answer 2

This has to be CMSAlgorithm.DES_EDE3_CBC encrypted from the identity certificate and Base64 encode the result. That result needs to be signed as you did in the previous stage.