title: Apple MDM Vendor CSR Signing
body: <p>I hit '<strong>Invalid Certificate Signing Request</strong>' when uploading plist to <a href="https://identity.apple.com/pushcert/" rel="noreferrer">https://identity.apple.com/pushcert/</a> , and below are steps I used to generate plist : </p>
  
  <ol>
  <li>As a vendor, create vendor CSR using KeyChain Access of the MacBook to upload to member centre to generate MDM signing certificate, and export private key from KeyChain Access in p12 format, say vendor.p12</li>
  <li>Create customer CSR, using Openssl :<br/>
  <strong>- openssl genrsa -des3 -out customerPrivateKey.pem 2048
  <br/>- openssl req -new -key customerPrivateKey.pem -out customer.csr</strong></li>
  <li>As a vendor, download MDM signing certificate, WWDR intermediate certificate from provisioning portal, and download Apple root certificate from <a href="http://www.apple.com/appleca/AppleIncRootCertificate.cer" rel="noreferrer">http://www.apple.com/appleca/AppleIncRootCertificate.cer</a>, then use below command to convert these three certs to PEM format one by one which will be read by program as the PushCertCertificateChain :
  <br/><strong>- openssl x509 -inform der -in AppleWWDRCA.cer -out chain.pem</strong></li>
  <li>As a vendor, following sample java code in Mobile Device Management Protocol Reference, I sign the customer.csr with the private key extracted from vendor.p12</li>
  <li>Using Safari to upload generated plist to <a href="https://identity.apple.com/pushcert/" rel="noreferrer">https://identity.apple.com/pushcert/</a> with customer Apple ID</li>
  </ol>
  
  <p>Is there anything wrong with above steps? Please advise. Thanks a lot!</p>