Repository navigation
Conversation
cryptography cannot serialize with an empty password, so shell out to openssl for this one container. Keeps the friendly name so Android does not ask for one.
SecPKCS12Import cannot open an empty-password container, so Apple gets the passworded one with the password embedded in the profile. Installs prompt-free.
The password-less PKCS12 is generated by shelling out to it, so do not rely on the base image happening to ship it.
CSR-enrolled people get a cert-only one rather than none, so the download endpoint never has to serve the passworded container the UI cannot explain.
iOS only hands a .mobileconfig to the profile installer on a real navigation, which carries no Authorization header. Admin-code users never had the cookie.
It is a certificate concern, not an ORM one. Also logs openssl's stderr, which capture_output was swallowing into an unexplained 500.
Contributor
|
How about we don't start shells, especially not in rmapi which has by far the highest damage potential if compromised. We have lived with the password prompt so far and can live with it in the future until the needed feature is exposed in upstream. We can even supply them with a patch. |
benjamsf
marked this pull request as draft
September 20, 2026 15:00
benjamsf
marked this pull request as draft
September 20, 2026 15:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Get rid of the password in pfx's as that has always only been an iOS compatibility thing.
.mobileconfigendpoint instead, carrying the passworded container plus its password. Installs with no password prompt.POST /enduserpfx/sessionmints the JWT cookie, because iOS only hands a profile to its installer on a plain navigation, which sends no auth header.User-Facing Changes
No password when installing your certificate
Installing your certificate no longer asks for a password. On Android the install is two taps with nothing to type.
iPhone and Mac install a configuration profile
Apple devices now download a configuration profile instead of a certificate file, installed from Settings. No password at any point.
Anything Else You'd Like to Mention
opensslfor this one container because pyca/cryptography refuses to serialize with an empty password, and itsNoEncryption()alternative produces a container the JDK reads as empty. This meansopenssladded to the production image => should it be moved to libpvarki.