使用mobileconfig在ios系统上部署vpn配置和证书

企业开发 2018-05-09 15:55:04 阅读次数: 2
apple已不再提供Windows上的apple configurator工具，所以只能自己手写了
文件模板 
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!-- Set the name to whatever you like, it is used in the profile list on the device -->
    <key>PayloadDisplayName</key>
    <string>hk ikev2 config</string>
    <!-- This is a reverse-DNS style unique identifier used to detect duplicate profiles -->
    <key>PayloadIdentifier</key>
    <string>192.168.5.105</string>
    <!-- A globally unique identifier, use uuidgen on Linux/Mac OS X to generate it -->
    <key>PayloadUUID</key>
    <string>9f93912b-5fd2-4455-99fd-13b9a47b4581</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadContent</key>
    <array>
        <!-- It is possible to add multiple VPN payloads with different identifiers/UUIDs and names -->
        <dict>
            <!-- This is an extension of the identifier given above -->
            <key>PayloadIdentifier</key>
            <string>192.168.5.105</string>
            <!-- A globally unique identifier for this payload -->
            <key>PayloadUUID</key>
            <string>29e4456d-3f03-4f15-b46f-4225d89465b7</string>
            <key>PayloadType</key>
            <string>com.apple.vpn.managed</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <!-- This is the name of the VPN connection as seen in the VPN application later -->
            <key>UserDefinedName</key>
            <string>hk ikev2 config</string>
            <key>VPNType</key>
            <string>IKEv2</string>
            <key>IKEv2</key>
            <dict>
                <!-- Hostname or IP address of the VPN server -->
                <key>RemoteAddress</key>
                <string>192.168.5.105</string>
                <!-- Remote identity, can be a FQDN, a userFQDN, an IP or (theoretically) a certificate's subject DN. Can't be empty.
                     IMPORTANT: DNs are currently not handled correctly, they are always sent as identities of type FQDN -->
                <key>RemoteIdentifier</key>
                <string>192.168.5.105</string>
                <!-- Local IKE identity, same restrictions as above. If it is empty the client's IP address will be used -->
                <key>LocalIdentifier</key>
                <string></string>
                <!-- The server is authenticated using a certificate -->
                <key>AuthenticationMethod</key>
                <string>Certificate</string>
                <!-- The client uses EAP to authenticate -->
                <key>ExtendedAuthEnabled</key>
                <integer>1</integer>
                <!-- User name for EAP authentication. Since iOS 9 this is optional, the user is prompted when the profile is installed -->
                <key>AuthName</key>
                <string>test</string>
                <!--<key>AuthPassword</key>
                <string></string>-->
            </dict>
        </dict>
        <!-- This payload is optional but it provides an easy way to install the CA certificate together with the configuration -->
        <dict>
            <key>PayloadIdentifier</key>
            <string>caCert.ca</string>
            <key>PayloadUUID</key>
            <string>64988b2c-33e0-4adf-a432-6fbcae543408</string>
            <key>PayloadType</key>
            <string>com.apple.security.root</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <!-- This is the Base64 (PEM) encoded CA certificate -->
            <key>PayloadContent</key>
            <data>
MIIDVzCCAj+gAwIBAgIIUF9vCfksOkswDQYJKoZIhvcNAQEFBQAwOTELMAkGA1UE
................................................................
m5YbMsFYzWq4YEIOxAk09/6VUdLAskOKW73PWmZdu/IWyivKuNy1wh+UYw==
            </data>
        </dict>
    </array>
</dict>
</plist>

 test.mobileconfig

不管证书认证还是用户名认证AuthenticationMethod的值都是Certificate，如果证书认证ExtendedAuthEnabled=0，并且 PayloadCertificateUUID=后面所附client证书的UUID，例如
<key>PayloadCertificateUUID</key> <string>d60488c6-328e-4944-9c8d-61db8095c864</string>
如果用户名认证ExtendedAuthEnabled=1，并在下面加入用户名密码，如果没有在安装配置时iphone会提示输入
<!-- User name for EAP authentication. Since iOS 9 this is optional, the user is prompted when the profile is installed -->
<key>AuthName</key>
<string>test</string>
<!--<key>AuthPassword</key>
<string></string>-->
 
末尾所附证书为pem格式，并且去掉begin,end行，不然证书不识别，把der证书转为pem格式
openssl x509 -in caCert.der -inform DER -out caCert.pem -outform PEM
最后用邮件发送或放到http服务器上，放在http服务器上时需要添加mime
/etc/apache2/mods-enabled/mime.conf
加入
AddType application/x-apple-aspen-config .mobileconfig
service apache2 restart
 
 
微软也有个创建vpn文件的工具，似乎还支持ios 
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!-- Set the name to whatever you like, it is used in the profile list on the device -->
    <key>PayloadDisplayName</key>
    <string>hk ikev2 config</string>
    <!-- This is a reverse-DNS style unique identifier used to detect duplicate profiles -->
    <key>PayloadIdentifier</key>
    <string>192.168.5.105</string>
    <!-- A globally unique identifier, use uuidgen on Linux/Mac OS X to generate it -->
    <key>PayloadUUID</key>
    <string>9f93912b-5fd2-4455-99fd-13b9a47b4581</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadContent</key>
    <array>
        <!-- It is possible to add multiple VPN payloads with different identifiers/UUIDs and names -->
        <dict>
            <!-- This is an extension of the identifier given above -->
            <key>PayloadIdentifier</key>
            <string>192.168.5.105</string>
            <!-- A globally unique identifier for this payload -->
            <key>PayloadUUID</key>
            <string>29e4456d-3f03-4f15-b46f-4225d89465b7</string>
            <key>PayloadType</key>
            <string>com.apple.vpn.managed</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <!-- This is the name of the VPN connection as seen in the VPN application later -->
            <key>UserDefinedName</key>
            <string>hk ikev2 config</string>
            <key>VPNType</key>
            <string>IKEv2</string>
            <key>IKEv2</key>
            <dict>
                <!-- Hostname or IP address of the VPN server -->
                <key>RemoteAddress</key>
                <string>192.168.5.105</string>
                <!-- Remote identity, can be a FQDN, a userFQDN, an IP or (theoretically) a certificate's subject DN. Can't be empty.
                     IMPORTANT: DNs are currently not handled correctly, they are always sent as identities of type FQDN -->
                <key>RemoteIdentifier</key>
                <string>192.168.5.105</string>
                <!-- Local IKE identity, same restrictions as above. If it is empty the client's IP address will be used -->
                <key>LocalIdentifier</key>
                <string></string>
                <!-- The server is authenticated using a certificate -->
                <key>AuthenticationMethod</key>
                <string>Certificate</string>
                <!-- The client uses EAP to authenticate -->
                <key>ExtendedAuthEnabled</key>
                <integer>1</integer>
                <!-- User name for EAP authentication. Since iOS 9 this is optional, the user is prompted when the profile is installed -->
                <key>AuthName</key>
                <string>test</string>
                <!--<key>AuthPassword</key>
                <string></string>-->
            </dict>
        </dict>
        <!-- This payload is optional but it provides an easy way to install the CA certificate together with the configuration -->
        <dict>
            <key>PayloadIdentifier</key>
            <string>caCert.ca</string>
            <key>PayloadUUID</key>
            <string>64988b2c-33e0-4adf-a432-6fbcae543408</string>
            <key>PayloadType</key>
            <string>com.apple.security.root</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <!-- This is the Base64 (PEM) encoded CA certificate -->
            <key>PayloadContent</key>
            <data>
MIIDVzCCAj+gAwIBAgIIUF9vCfksOkswDQYJKoZIhvcNAQEFBQAwOTELMAkGA1UE
................................................................
m5YbMsFYzWq4YEIOxAk09/6VUdLAskOKW73PWmZdu/IWyivKuNy1wh+UYw==
            </data>
        </dict>
    </array>
</dict>
</plist>

 test.mobileconfig

不管证书认证还是用户名认证AuthenticationMethod的值都是Certificate，如果证书认证ExtendedAuthEnabled=0，并且 PayloadCertificateUUID=后面所附client证书的UUID，例如
<key>PayloadCertificateUUID</key> <string>d60488c6-328e-4944-9c8d-61db8095c864</string>
如果用户名认证ExtendedAuthEnabled=1，并在下面加入用户名密码，如果没有在安装配置时iphone会提示输入
<!-- User name for EAP authentication. Since iOS 9 this is optional, the user is prompted when the profile is installed -->
<key>AuthName</key>
<string>test</string>
<!--<key>AuthPassword</key>
<string></string>-->
 
末尾所附证书为pem格式，并且去掉begin,end行，不然证书不识别，把der证书转为pem格式
openssl x509 -in caCert.der -inform DER -out caCert.pem -outform PEM
最后用邮件发送或放到http服务器上，放在http服务器上时需要添加mime
/etc/apache2/mods-enabled/mime.conf
加入
AddType application/x-apple-aspen-config .mobileconfig
service apache2 restart
 
 
微软也有个创建vpn文件的工具，似乎还支持ios

猜你喜欢

转载自haohetao.iteye.com/blog/2369760
今日推荐
火速冲上 GitHub 热榜 —— 开源编程语言、框架哪有这么可爱？
北京人形机器人创新中心发布全球首个纯电驱拟人奔跑的全尺寸人形机器人“天工”
LFOSSA 源来如此公开课 | 掌握云原生未来：CNCF 认证全面攻略与备考秘籍
国产云输入法——仅华为无云端数据上传安全问题
开源日报 | 工业开源项目OGG 1.0；姐姐，你要和我一起配置火狐吗；苹果AI遥遥落后？Fedora 40
开放签电子签章：停止新增，优化体验，前进更进（五一假期前工作）
开源日报 | 中学生开源前端动画引擎；全球首个Llama3 8B中文版开源模型；联想电脑恐出局；Linus讽刺AI炒作
周排行
浏览器对同一域名进行请求的最大并发连接数
React Hook之自定义Hook
【转】MyBatis缓存机制
-Java-泛型
自动化测试常用脚本-发送邮件
LeetCode#859: Buddy Strings
java、Python处理字符串
第二篇の博客
Hadoop伪分布式环境安装
SQL Server进阶（十一）临时表、表变量
每日归档
更多
2024-04-27(56)
2024-04-26(39)
2024-04-25(22)
2024-04-24(36)
2024-04-23(26)
2024-04-22(39)
2024-04-21(0)
2024-04-20(6)
2024-04-19(5)
2024-04-18(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022