About trust and certificates
Each Trust Store contains three categories of certificates:
- Trusted certificates establish a chain of trust that verifies other certificates signed by the trusted roots — for example, to establish a secure connection to a web server. When IT administrators create Configuration Profiles, these trusted root certificates don't need to be included.
- Always Ask certificates are untrusted but not blocked. When one of these certificates is used, you'll be prompted to choose whether or not to trust it.
- Blocked certificates are believed to be compromised and will never be trusted.
Install ROOT on your laptop If you prefer, you can install ROOT on your own system; it’s available for Mac OS X, Linux, and Windows. You can find it at Download the “Pro” binaries for your operating system. Flash Root Package: Odin can also Flash Custom Root packages to letting root access on your device. Can we use Odin on Mac? Odin is only designed for Windows OS. Samsung developers are still working on the compatibility of Odin on other OS like Mac or Linux. You can still use Odin on Mac as some experts designed JOdin which is compatible with Mac. Manually installing root certificate on Mac OSX NOTE: The following is based on OSX Yosemite 10.10.5. Other OS versions will have similar settings but they may not be worded the same or may be in slightly different places. Login to the web admin and click the Download Root Certificate button under Apps SSL Inspector Settings. From CERN's ROOT download page first choose the Pro version and then select the Mac OS X Binary (.tar.gz). In the example below, the 10.12 version was downloaded. Places where your version may differ are indicated in italics.
Current Trust Store
Previous shared Trust Stores
Beginning with iOS 12, macOS 10.14, watchOS 5, and tvOS 12, all four Apple operating systems use a shared Trust Store. As the Trust Store version is updated, previous versions are archived here:
Cern Root Draw
Archived Trust Stores
iOS
macOS
- List of available trusted root certificates in OS X El Capitan
- List of available trusted root certificates in OS X Yosemite
watchOS
- List of available trusted root certificates in watchOS 2
tvOS
Introduction
Mac Self-Service is a functionality within the Mac Desktop Service built and maintained to empower CERN users by giving them easy access to applications and configurations through the Self-Service application. It also enables CERN users to acquire Mac App Store applications through the Apple Volume Purchasing Program. Access to licensed software is restricted to Macs that are regurarely on site.
Mac Self-Service is based on the pull philosophy. CERN users join the Self-Service by enrolling their Mac in the CERN MDM, which requires logging-on with their CERN credentials and then downloading and installing the Self-Service application. This enables the users to select the applications they would like to install or the settings they would like to apply on their Mac.
The enrolment and the Self-Service app use Single-Sign-On. SSO to these services works with username and password or with an existing kerberos token. The SSO for these services does not work with user certificates.
If the device on which you intend to install this software is owned by an external university or institute, please ensure that you have the right to authorise the enrollment.
To enrol you Mac in the Mac Self-Service, click here:https://mdm.cern.ch/enrol
Enrolling with macOS 10.12.6 or earlier (obsolete)
macOS versions older than 10.13 are not supported any more. It is known that the Self-Service for these versions stopped working with the server side upgrade we made in August 2020.
On macOS versions up to 10.12.6 the package CernSelfService.pkg was downloaded directly. Once the download was complete you could (double) click the package to open it with the Installer and follow the installation instructions.
Enrolling with macOS 10.13 or newer
On recent versions of macOS two profiles are downloaded and installed (first a 'CA Certificate' and then an 'MDM Profile'), for each of these the user is asked several times for confirmation. The framework and the Self-Service app are then pushed from the server in the background. Due to this it might take a few minutes until the Self-Service app is installed on newer versions of macOS.
Using the Self-Service
When starting the Self-Service for the first time users should run the policy 'Trust CERN CA Certificates' to ensure that the Mac trusts the certificates issued by CERN's Certification Authority, needed for the installation of products via the Self-Service.
Access to licensed software is only granted to properly registered Macs that have been on site recently. Even for Macs that are on site there is delay of a few minutes between the enrollment and the check for eligibility, which means that licensed software is not visible directly after the enrollment. Macs that are registered in the network database as 'visitor-xyz' are not eligible for licensed software.
On the technical level, the Self-Service works based on the MDM agent, which is installed during the enrolment process. The MDM agent runs with local admin privileges in order to automate installations, manage software dependencies and gather information about the hardware and software, which helps the Mac Desktop Service team provide a better service. The Mac Desktop Service team is committed to ensure confidentiality of this information.
Updates to the applications installed through the Self-Service are handled by mechanisms provided by these applications themselves - in exactly the same way as when these applications are installed outside of the Self-Service. Although technically possible, the Mac Desktop Service team does not push any updates, settings or applications to the Macs enrolled in the Self-Service.
However, in case you would like to remove Self-Service, and you have not installed any CERN licensed software, simply execute the following command in terminal :
sudo jamf removeframework
Please 'Quit' the Self-Service app.
The Self-Service app goes into weird state when kept open for too long, and will probably use a large fraction of your Macs network bandwidth. To avoid that the Self-Service app wastes too many resources please quit the app when you are done.
About Migration Assistant, Restoring from Time Machine and Replaced Motherboards
When a new Mac is set up using the migration assistant directly or via Time Machine or when a Mac has its motherboard replaced that Mac might also receive the Self-Service.app and the jamf framework, but the Self-Service server will not accept any connection from that Mac since the new Mac is unknown to the server. The same holds for any other intervention that changes the serial number and/or the UDID of the Mac. For these devices we recommand to run the 'sudo jamf removeframework' and then enroll the new Mac by visiting https://mdm.cern.ch/enrol.
About the Self-Service Application Version
The Self-Service application gets updated automatically whenever the server version is updated - as long as the Self-Service framework on your Mac is still working properly. Since August 2020 the version of the Self-Service app should be 10.23.0. If your Self-Service app is older than 10.23.0 you can assume that there is a problem with the Self-Service framework on your Mac. In general that implies that the Self-Service itself will not be functioning any more, and we recommend that you re-enroll the Mac by visiting https://mdm.cern.ch/enrol.
About Devices that Stop Reporting
Devices that stop reporting for more than three months (more than 12 month for devices that use disk encryption) will be deleted from the database. In that case the Self-Service will not work anymore. Reasons for stopping to report include
Root Cern Install
- the device is switched off
- the framework has been corrupted
- the framework failed to upgrade when the server side software was upgraded
Please Report all Self-Service Related Problems to the Service Desk
Cern Root Fit
We can discover some Self-Service issues on the server side, but for the majority of issues we rely on you reporting malfunctions to become aware of problems. So in please report any issues with the Self-Service to the Service Desk, see https://cern.service-now.com/service-portal