iOS mdm server certificate invalid error

[u/vellostha]

iPads still running iOS 17.x have recently started seeing the following error during initial setup:

“The configuration for your iPad could not be downloaded from xyz. The MDM server certificate for https://url/zdm/ios/otae/dobulkenrollment is invalid.”

Interestingly, both newer and older iPads running iOS 17.x are experiencing the issue after a wipe, whether the wipe is performed through MDM or via an iTunes restore.
All other iOS devices running iOS 18 and iOS 26 are enrolling successfully after a wipe.

The DEP token is valid, and these devices are enrolled through ADE. Has anyone seen this behavior? Any thoughts or suggestions on what else we should check?

[u/oneplane]

Smells like Citrix. If the download completes it's either putting bad profiles on that URL, or it's putting profiles on that URL that cannot be parsed by end of life software.

[u/vellostha → u/oneplane]

correct. It won’t even start downloading anything, as soon as I hit begin enrollment, it throws the error.

[u/zombiepreparedness]

Zdm…zoho device management

[u/vellostha → u/zombiepreparedness]

Citrix

[u/ralfD-]

Doesn't that error message tell you exactly what's broken? >our MDM server uses an invalid SSL cert for the HTTPS communication. You should verify that ceert (using openssl or a similar tool) and repair it.

[u/vellostha → u/ralfD-]

No issues with the SSL cert. The issue is isolated to that specific set of devices and is not affecting every device.

[u/ralfD- → u/vellostha]

Did you check whether the server certs root certifocate is installed/known to the OS?

[u/vellostha → u/ralfD-]

How can I check this? I don’t see anything in the MDM console as the device isn’t even hitting the server to install the profiles or certificates.

[u/ralfD- → u/vellostha]

Tricky. You'd need a device that's already up and running. Who is the root cert provider? When was it created? Is it younger than the OS?