"Enroll profile sending error. Please contact your administrator" during iOS enrollment in Universal Device Service

• Universal Device Service

During the activation process on the iOS device an error is received stating:

Enroll profile sending error. Please contact your administrator

Within the Communication Module logs, the following error may be logged

Error 1

FATAL,"2012-05-08 10:31:44,668",10,0,"efa025b7-b976-46dc-b536-8cd5f3192c4b","Enroll profile sending error. Please, contact your administrator.",
,Type: System.NullReferenceException
,Message: Object reference not set to an instance of an object.
,Source: RIM.BUDS.Core.Client
,TargetSite: "Boolean IsMdmMessagesAuthenticationValid(System.String, Int32, System.String ByRef)"
,StackTrace:    at RIM.BUDS.Core.Client.Model.Tenant.IsMdmMessagesAuthenticationValid(String platformName, Int32 tenantId, String& message) in c:\ec_build\604689\BUDSServer\source\enterprise\BUDS\Server\Sources\RIM.BUDS.Core.Client\Model\Tenant.cs:line 229
,   at RIM.BUDS.Communication.iOS.ProfileServices.Handlers.EnrollHandler.DoEnroll(Boolean isDeviceClient, Int32 tenantId, Int32 userId, String hash, String language, String osVersion) in c:\ec_build\604689\BUDSServer\source\enterprise\BUDS\Server\Sources\RIM.BUDS.Communication.iOS\ProfileServices\Handlers\EnrollHandler.cs:line 63

Error 2

FATAL,"2013-01-02 11:41:02,751",6,0,"4394e826-747d-40e1-b3e9-3dd60bfe91f5","Enroll profile sending error. Please, contact your administrator.",
,Type: System.Security.Cryptography.CryptographicException
,Message: Keyset does not exist

,Source: System.Security
,TargetSite: "CMSG_SIGNER_ENCODE_INFO CreateSignerEncodeInfo(System.Security.Cryptography.Pkcs.CmsSigner, Boolean)"
,StackTrace:    at System.Security.Cryptography.Pkcs.PkcsUtils.CreateSignerEncodeInfo(CmsSigner signer, Boolean silent)
,   at System.Security.Cryptography.Pkcs.SignedCms.Sign(CmsSigner signer, Boolean silent)
,   at System.Security.Cryptography.Pkcs.SignedCms.ComputeSignature(CmsSigner signer, Boolean silent)
,   at RIM.BUDS.Communication.iOS.ProfileServices.MessageSigner.Sign(Byte[] input, X509Certificate2 signerCertificate, X509Certificate2 caCertificate) in c:\ec_build\898095\BUDSServer\source\enterprise\BUDS\Server\Sources\RIM.BUDS.Communication.iOS\ProfileServices\MessageSigner.cs:line 36
,   at RIM.BUDS.Communication.iOS.ProfileServices.Handlers.EnrollHandler.DoEnroll(Boolean isDeviceClient, Int32 tenantId, Int32 userId, String hash, String language, String osVersion) in c:\ec_build\898095\BUDSServer\source\enterprise\BUDS\Server\Sources\RIM.BUDS.Communication.iOS\ProfileServices\Handlers\EnrollHandler.cs:line 123
DEBUG,"2013-01-02 11:41:02,821",6,183,"4394e826-747d-40e1-b3e9-3dd60bfe91f5","HTTP Request Completed: https://u01app05sen139.sen139.bcts.cso.labs.rim.net/ios/enroll/2/English/5.1.1",

Error 1

The APNs certificate has not been installed through the administration console.

Error 2

Under Manage Private Keys for the SSL cert, the Everyone group is missing Read permissions.

Resolution 1

Follow the steps within the console to request and import the APNs certificate into the Universal Device Service.

For more information about how to request and install APNs Certificate into Universal Device Service, see the Administration Guide: http://docs.blackberry.com/en/admin/deliverables/40336/Universal_Device_Service-Administration_Guide-1320166294125-6.0-en.pdf

Resolution 2

Open up the Certificate Snap In tool using MMC

Right-click on the SSL Certificate and select All Tasks > Manage Private Keys

Ensure the Everyone Group has Read Permissions.