Error distributing app in MDM to iOS 8

Question

We have 3 Enterprise iOS apps that are distributed via MDM (Symantec App Center). The apps have security policies configured within app center which means they re-wrap the app with a wrapper library before they distribute that app. This has been working great until the release of iOS 8. When you try to run the apps on iOS 8 they immediately crash. If I deploy the apps directly to the same iPad outside of the MDM tool they run fine.

The log shows

Dyld Error Message: Library not loaded: @executable_path/nukonize.dylib

(Nukona was the original name of Symantec App Center, and that library is for their app wrapper).

Things to note: - Tried with other MDM (AirWatch) and I see the same issue. - Vendor resigns the app with their enterprise distribution certs and they don't see the problem. - I sign the app with my personal developer distribution cert we don't see the problem. - We deploy the app outside of the MDM solutions to the same iPad, we don't see the problem. - We deploy to iOS 6.x or 7.x iPads through the MDM we don't see the problem.

To rule out a code problem, I built a Hello World application that does nothing other than show Hello World on the screen. Deploy it through the MDM and it has the same problem.

Everything points to a problem with our distribution cert/account but I can't think for the life of me what that might be. Any suggestions to help resolve this would be much appreciated.

Answer 1

The app would install fine. It was only when it launched that the problem showed up. The launch screen shows very briefly then the app crashes.

Working with AirWatch we discovered the solution to the issue. Our signing certificate was created prior to the release of iOS 8 and was missing an OU element that is present on certs created after iOS 8. Evidently this is used in the wrapping process.

We had to create a new distribution cert and sign the app with that. Once we did the app luanched correctly.

So if you run into a similar problem, check your distribution cert to see if there is an OU on it. If there isn't you will have to create a new one.