Thank you Eskimo! I have couple more related questions.
General questions about iOS configuration profiles:
When create certificate in Apple Configurator 2 there’s option to sign in with certificate, I understand it necessary for security purposes and we need to renew profile when certificate expires, right?
What happens after “signing” certificate is expired for already installed profile, would profile restrictions still work for device or there's any action to take?
Questions related to profile install checks:
I used tutorial to create Certificate Authority from here: https://blog.arrogantrabbit.com/ssl/Root-CA-macOS/ I am not sure if I better stick with default values provided by the creation wizard or follow this tutorial to apply some modifications? I guess from your answer default values should be fine for X.509 policy.
CA root & leaf certificate have expiration dates. In creation wizard setup is up to 999 days. After 999 days trust evaluation will fail with error “MyCert” certificate is expired”. Is there an option to extend this certificate lifetime/expiration date to 10/20/30 years for example? I can also think of other option to return successful evaluation for this specific kind of error, but not sure it’s safe or might fall for another close related error? Basically I wouldn’t like to force user to re-install / install additional updated profile for this check to work after 2 years.
Thanks, Dzmitry.