topic Re: Encryption in Endpoint Security

Encryption

pedrocallrail — Wed, 08 Nov 2023 21:10:56 GMT

What does this mean? The encryption certificate referenced by the FileVault Recovery Key Escrow payload is invalid or does not support encryption.

Re: Encryption

BlakeRichardson — Wed, 08 Nov 2023 21:44:53 GMT

It sounds like System manager isn't able to access the Fault vault recovery key because the payload is corrupted or something has gone wrong when the device uploaded the payload to systems manager.

Is the MDM certificate on the device still valid or has it expired?

Re: Encryption

Arthur Dent — Fri, 10 Nov 2023 12:42:18 GMT

@pedrocallrail Can you take us through the flow you use to create the certificate, and which type of FileVault profile you are using?

Re: Encryption

pedrocallrail — Tue, 14 Nov 2023 20:24:33 GMT

I'm following: https://documentation.meraki.com/SM/Other_Topics/Creating_a_Public%2F%2FPrivate_Certificate_Pair and https://documentation.meraki.com/SM/Profiles_and_Settings/Using_File_Vault_2 It is not providing a .pem certificate. I am trying to create a :

macOS FileVault Recovery Key Escrow profile

Re: Encryption

aleabrahao — Thu, 07 Dec 2023 19:30:51 GMT

Creating a macOS FileVault Recovery Key Escrow profile involves generating a public/private key pair and then using the public key to encrypt the FileVault recovery key.

You can use a tool like OpenSSL to generate a public/private key pair. The private key should be kept secure, as it will be used to decrypt the FileVault recovery key.

In the Meraki dashboard, create a new profile and select the ‘FileVault Recovery Key Escrow’ payload. In the ‘EncryptCertPayloadUUID’ field, enter the UUID of the payload that contains the public key. This will be used to encrypt the recovery key.

Once the profile is created, you can apply it to your devices. The devices will then escrow their FileVault recovery keys, encrypted with the public key, to the Meraki dashboard.

Please note that the certificate file used for the ‘EncryptCertPayloadUUID’ field should be in PEM format. If you’re having trouble generating a PEM certificate, you might want to check the commands you’re using with OpenSSL.

The typical command to generate a PEM encoded certificate is something like this:

openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout server.key -out server.crt

This command generates a new RSA key (server.key) and a self-signed certificate (server.crt). Both are in PEM format.