Filevault Personal Recovery key escrow

[sshort]

@Melissa Do you have any insight on updated documentation for the new FileVault personal key escrow payload?

https://documentation.meraki.com/SM/Profiles_and_Settings/Using_File_Vault_2

The FV2 personal key escrow is a separate payload from the "standard" filevault settings, and there's a required field that's essentially a black hole b/c I can't find any info on finding or generating the requested certificate.

Right now I created a test Filevault payload that only enforces a personal recovery key and pushed to a single Mac client so that I can try and pull the mobileconfig/plist apart using the suggestions on this page to get the cert: https://www.macblog.org/post/how-to-manage-only-filevault-recovery-key-escrow-with-jamf-pro/

Would be nice if the dropdown menu on this payload was pre-filled with my existing FileVault profile, or a quick template that has Meraki auto-generating the required cert for me...

       

[Melissa]

Hi @sshort! We should have a new guide on this configuration setting posted soon on our Documentation site. I'll post a link to it in the Community asap!

[sshort]

Ok, there's some updated documentation on FileVault escrow but you need to "fill-in-the-blank" by generating your own public/private ssl cert to upload to Meraki. Also: as noted in Meraki's documentation this will not work on existing deployments. Newly enrolled devices (or freshly re-imaged Macs) will be able to take advantage of the escrowed keys. The escrow payload must be installed before (or simultaneously) with a separate FV personal + institutional key payload for this to work.

 Generate the public key certificate in Terminal using openssl:

https://developer.xero.com/documentation/api-guides/create-publicprivate-key

OR this site (scroll down to the create SSL section): http://brianflove.com/2014/12/01/self-signed-ssl-certificate-on-mac-yosemite/

[didacf]

Hey 

I just did the same, in the documentation, it was missing to either do a self-signed certificate or use a CSR to your own CA authority. It worked great!!