# Signing the `.mobileconfig`

The portal **always signs** the profile after the PKCS#12 payload is embedded. Unsigned profiles install with a warning; a signature that the device trusts shows as verified.

## Signing identity

`PROFILE_SIGNING_P12_PATH` is a PKCS#12 (`.p12` / `.pfx`) containing:

- The signer private key
- The signer certificate
- Optional intermediates (included in the CMS)

The **device must already trust** this certificate (or its issuer). Typical sources:

- An internal TLS/code-signing/profile-signing CA already deployed by MDM or a root payload
- A dedicated “configuration profile signing” cert from that CA

This file is **not** the per-user identity P12. It is long-lived and stored on disk. Protect it like any other service credential (`chmod` / secret mount).

## What the portal does

After building the XML plist it creates an **attached** CMS `SignedData` (DER):

```
openssl smime -sign \
  -signer cert.pem -inkey key.pem -certfile chain.pem \
  -nodetach -outform der \
  -in unsigned.mobileconfig -out signed.mobileconfig
```

Implementation: `cryptography` `PKCS7SignatureBuilder`, SHA-256, `Encoding.DER`, `PKCS7Options.Binary` (so the XML is not canonicalized). Detached signatures are not used; Apple needs the profile bytes inside the CMS.

## Trust on the device

- If the signer chains to a root already on the iPhone/Mac, Settings shows the profile as signed/verified.
- If not, the user can still install it (with a warning) unless an MDM policy forbids unsigned/untrusted profiles.

Deploy the signing CA with MDM or an earlier profile before you depend on a “verified” badge.

## Rotation

Replace the P12 on disk and restart the process. Old profiles remain valid; new downloads use the new signer. Keep the old CA trusted until you do not care about old profiles.