Have you ever deploy the OSX certificate by BigFix client on the latest Mac OS

Content Authoring
1

Dear,
My customer want to deploy the Certificate to their whole BigFix clients.
The Fixlet works well on Windows clients.
But, The Fixlet for Mac does not work properly.
The return code is “1”
We want to the certificate whth always trusted status to Mac machine.
I can see the certificate in keychain. But the status of the certificate is not trusted.
I remember that the Fixlet worked on the old OSX version.
Unfortunately, I can not deploy the certificate properly for the new Mac OS properly.
I do not know the exect OS versioin.
From about 2 or 3 year ago, I cannot deploy the Mac certificate by BigFix client.

I know that the BigFix MDM can do this, Unfortunately, my customer does not use the MDM and they are using closed network.

I used below code.
Is ther anybody can solve this issue?
Now my customer is considering using JAMF seriously.

Thank you^^

prefetch MenloSecurityCustomerRootCA_0412crt.tmp sha1:69fb0975a8b0514ea61f0201cb1d1e6df3ac6a63 size:1593 http://nbmt.kys.local:52311/Uploads/69fb0975a8b0514ea61f0201cb1d1e6df3ac6a63/MenloSecurityCustomerRootCA_0412crt.tmp sha256:83e58e53730fdd418caf3018dbb039d5e059406c9d18c7a4cba5f4dbcd5b495d

extract MenloSecurityCustomerRootCA_0412crt.tmp

if {not active of action OR exists file whose (name of it ends with “.tmp”) of folder “__Download” of client folder of current site}
delete “{pathname of file whose (name of it ends with “.tmp”) of folder “__Download” of client folder of current site}”
endif

wait su root -c sudo security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”

wait su -c sudo security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”

wait /usr/bin/security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”
// wait /bin/sh -c security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”
// wait /usr/bin/security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”
wait security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”
wait su {name of current user} -c security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”
wait su -c security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”
wait su root -c security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”
wait sudo su {name of current user} -c security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”
wait sudo su -c security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”
wait sudo su root -c security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “{posix path of client folder of current site}/__Download/MenloSecurityCustomerRootCA_0412.crt”
// wait bi -c security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” __Download/MenloSecurityCustomerRootCA_0412.crt

2

Have you tested running these commands locally, excluding the BigFix folder path? If they execute successfully in a local environment, they should function properly from within BigFix as well. However, I noticed a potential issue with the command su root -c sudo . While I’m not an expert in Linux/Unix systems, typically, using sudo with su and specifying root is unnecessary?

In short you need to test, fix & replicate same command in BigFix action script.

1 Like
3

In today’s macOS, an MDM is required for IT management. This has been Apple’s direction for some time now. In 2024, if you’re trying to manage macOS without an MDM, you’re doing yourselves and your customers a disservice.

That said, it should be possible to add a trusted root via security add-trusted-root. Once you find something that works manually on a root shell, replicating it inside of BigFix is rather trivial.

(This solution will likely help.)