Profile & Installer Signing
When an employee enrolls a device, they install two kinds of Iterate-provided
artifacts: a macOS/iOS configuration profile (.mobileconfig) and, on
Windows, the AgentWatch Connect installer (.exe). This guide explains how
each is signed so the device shows a trusted “Verified publisher” instead of
an “unknown author” warning — and, importantly, why a private signing key is
never shipped inside the AgentWatch container image.
The short version
Section titled “The short version”| Artifact | Signed by | Customer action | Result |
|---|---|---|---|
Windows Connect installer (.exe) |
Iterate Studio Inc (EV cert, at build time) | None | “Verified publisher: Iterate Studio Inc.” out of the box |
macOS/iOS profile (.mobileconfig) — pushed via MDM |
Your MDM’s trusted channel | Push from Jamf/Intune/JumpCloud | Installs silently as a managed profile, no warning |
| macOS/iOS profile — self-service (manual install) | Optional: your own signing cert | One-time cert config per deployment | Green “Verified · <your org>”; unsigned otherwise |
Golden rule: the same AgentWatch image ships to every customer, so it contains no private signing keys. Signing keys are per-deployment secrets or are handled by your MDM.
Windows: the installer is already signed by Iterate
Section titled “Windows: the installer is already signed by Iterate”The AgentWatch-Connect-Setup-*.exe is Authenticode-signed with the Iterate
Studio Inc code-signing certificate as part of the release build, with an
RFC-3161 timestamp so the signature stays valid after the cert expires. Nothing
for you to configure — when an employee downloads and runs the installer,
Windows SmartScreen/UAC shows “Verified publisher: Iterate Studio Inc.”
Why signing runs at build time (not in cloud CI): the certificate is an Extended Validation (EV) code-signing cert whose private key lives on a hardware token. EV keys cannot be exported into a cloud CI secret by design, so signing happens on the release build machine that holds the token. If you ever need signing to move into a hosted CI pipeline, that requires a cloud signing service (e.g. Azure Trusted Signing or a HSM-backed KeyLocker) rather than the USB token — a separate setup.
macOS/iOS: choose a delivery path
Section titled “macOS/iOS: choose a delivery path”An unsigned profile installed manually makes macOS/iOS show “Not Signed — the author of this profile is unknown.” The profile still works, but the warning is unnerving for end users. There are three ways to avoid it — pick the one that matches how you deploy.
Path 1 (recommended for managed fleets): push via your MDM
Section titled “Path 1 (recommended for managed fleets): push via your MDM”If devices are enrolled in Jamf, Intune, JumpCloud, Kandji, etc., push the profile through the MDM instead of having users install it by hand. MDM- delivered profiles arrive over the MDM’s own trusted channel, install silently as Device (Managed), and never show the “unknown author” prompt — no profile signing needed at all. This is the cleanest option for corporate-owned devices.
Export the profile from AgentWatch (Enrollment Portal → download the profile, or the admin Agent Fleet → mobileconfig endpoints) and upload it as a custom configuration profile in your MDM.
Path 2 (self-service / BYOD): sign with your own identity
Section titled “Path 2 (self-service / BYOD): sign with your own identity”For self-service enrollment (the captive portal, where employees install the profile themselves), configure a signing certificate for your tenant. AgentWatch then signs every generated profile so devices show a green “Verified · <your organization>” badge. Because your organization is the party enrolling its own employees — and the profile trusts your deployment’s AgentWatch Root CA — showing your identity is the correct, expected behavior.
Configure it in the UI (recommended, per-tenant):
Settings → Enrollment Portal → Profile Signing. Paste your signer
certificate (PEM), private key (PEM), and optional intermediate chain, then
Save signer. Each tenant admin manages their own organization’s signer;
the private key is encrypted at rest (AES-256-GCM), stored server-side, and
never shown again (write-only; the certificate/chain are public and kept as-is).
The status line shows the active signer’s org and expiry, or “unsigned”. Signing
is per-tenant: exampletenant’s profiles are signed with exampletenant’s cert,
and only a super-admin can set the platform-wide default.
Or set deployment-wide env (single global signer — Iterate-hosted / single-tenant; used as a fallback when no per-tenant signer is set). Values may be inline PEM or a path to a PEM file:
MDM_PROFILE_SIGN_CERT signer certificate (PEM)MDM_PROFILE_SIGN_KEY signer private key (PEM)MDM_PROFILE_SIGN_CHAIN intermediate chain (PEM, optional but recommended)Resolution order at download time: this tenant’s signer → platform default → env fallback → unsigned.
Use a certificate whose chain devices already trust and whose Subject carries your org name. Two good choices:
- Apple Developer ID (from your organization’s Apple Developer account): chains to Apple’s built-in root, trusted by every Mac/iPhone with no extra steps; shows your team name.
- A publicly-trusted code-signing / S-MIME certificate issued to your organization by a public CA (DigiCert, Sectigo, GlobalSign, …).
A TLS server certificate (the kind used for HTTPS) usually can’t sign profiles — its key usage is wrong. Use a code-signing / Developer ID cert.
If no signing cert is configured, AgentWatch serves the profile unsigned (the manual-install warning applies) — so out-of-the-box installs still work, and you can adopt Path 1 or 2 whenever you’re ready.
Path 3 (Iterate-hosted tenants): signed by Iterate
Section titled “Path 3 (Iterate-hosted tenants): signed by Iterate”On Iterate-operated deployments, Iterate configures its own signing certificate as a deployment secret so hosted profiles are signed. That key stays on Iterate’s infrastructure and is never part of the image you receive.
Why the key is never in the image (security)
Section titled “Why the key is never in the image (security)”A code-signing private key baked into a distributed container image could be extracted by anyone who has the image and used to sign anything as your organization (or as Iterate). Public trust services revoke such certificates on discovery. AgentWatch therefore keeps signing keys out of the image entirely: they are either supplied per-deployment as secrets, held on a hardware token at build time (Windows), or replaced by your MDM’s trusted delivery channel.
Verifying a signed profile
Section titled “Verifying a signed profile”- macOS install dialog: a signed profile shows “Verified” in green with the signer’s organization, instead of “Not Signed.”
- Command line:
openssl smime -verify -inform DER -in profile.mobileconfig -noverifyprints the embedded plist (proves the CMS wrapper is intact); drop-noverifyto also validate the chain against your trust store.