BigFix MDM Server TLS Certificate Content

Understand the required format of the BigFix MDM Server TLS certificate for MDM Server installation.

BigFix MDM server TLS Certificate Content
The MDM Server certificate must be available in a .crt or .pem format, and must take the form of a certificate chain containing the following:
  • The actual MDM TLS certificate provided by the trusted CA
  • Any intermediate certificates provided by the trusted CA
  • The trusted CA root certificate
If your trusted Certificate Authority (CA) does not provide a complete certificate chain directly, you must manually create one by combining the server certificate, intermediate CA, and root CA certificates in the correct order and provide it as the MDM Server’s TLS certificate during MDM Server installation.
The following command is an example for concatenating certificates on Linux:
cat <server TLS .crt> [intermediate .crt] <CA root .crt> > <mdmserver.crt>

  • <server-TLS.crt> – The server's TLS certificate

  • [intermediate.crt] – The intermediate certificate (if applicable)

  • <CA-root.crt> – The root CA certificate

  • <mdmserver.crt> – The final concatenated certificate file to be used for the MDM server

This may require additional action on one or more files provided by a trusted CA to extract the various certificates and keys needed to build the required chain.
If your certificates are in a different format such as .pfx or .p12, you need to extract the individual certificates. These formats often bundle the private key and certificate chain into a single file.

You can refer to resources like the OpenSSL documentation for help extracting certificates from .pfx or .p12 files.

Encrypt TLS private key

To securely store the private key used while creating the CSR for the Trusted CA TLS certificate, you must encrypt it. Do the following to encrypt the TLS private key.
  1. Run the following command:

    When using RHEL8

    openssl rsa -des3 -in <TLSKEY>.key -out mdmserver.key
    When using RHEL9
    openssl rsa -des3 -in <PUSHCERTNAME>_temp.key -out <PUSHCERTNAME>.key -traditional
    where TLSKEY is the name of the key used when originally creating the TLS Certificate CSR.
  2. When prompted, enter the encrypted private key pass phrase of your choice.
  3. Verify it.
Important: Before uploading the private key to install the MDM server, you must decrypt it.