A basic rundown of CA chains: Say you have a security certificate claiming that you are example.com. But no one is going to believe you. So you get that signed by someone that people do trust (Verisign in your example above). Now, I believe that you are example.com because Verisign is vouching for you by signing your certificate.
Usually Verisign will not sign it with their main "root" certificate. Instead, they will sign it with a second-level CA, and that second-level CA is signed by the root certificate which I trust.
That's a certificate chain: You (example.com), are signed by a second-level CA, which is signed by a root CA.
So, when giving me your certificate, you also need to provide the whole chain so I can validate it all the way to the top and see if I actually trust you.
So, the following command takes your .mobileconfig file and signs it with your certificate. And I will trust your signature, so long as you provide the whole chain.
Files:
* company.mobileconfig <-- your .mobileconfig file you made
* signed.mobileconfig <-- the signed file that gets created after the command is done
* server.crt <-- your certificate which you got from a trusted CA
* server.key <-- your private key file which goes with the certificate above (keep safe)
* cert-chain.crt <-- whatever certificates are in the chain up to the top level CA that people trust
The command:
openssl smime -sign -in company.mobileconfig -out signed.mobileconfig
-signer server.crt -inkey server.key -certfile cert-chain.crt
-outform der -nodetach
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
