Casper Configuration Profiles Auto Renewal
If you are using AD certificates inside a configuration profile, here is the easiest way to make it auto renewal:
sudo defaults write /Library/Preferences/com.apple.mdmclient AutoRenewCertificatesEnabled -bool YES
I have setup an extension attribute to check the Macs need this remediation:
#! /bin/bash status=$(sudo defaults read /Library/Preferences/com.apple.mdmclient AutoRenewCertificatesEnabled) echo “
$status ”
Any Macs without the result 1 will get remediated :) Here is the link from Apple, it works for Sierra and up. By default, the auto renewal time is 14 days before expiring. Links to read: https://support.apple.com/en-us/HT204836 https://support.apple.com/en-us/HT204446 To find expired certificates:
expired=$(security find-identity | grep EXPIRED | awk ‘{print $2}’)
To delete a certificate:
security find-certificate -c “certificatename” -a -Z |
sudo awk ‘/SHA-1/{system(“security delete-certificate -Z “$NF)}’