Welcome to our community!

Sign macOS app

Alex Hart

7 years ago
updated 9 months ago
Completed

In order to deploy macOS privacy preferences policy via MDM/DEP, the macOS app in Mojave that needs exceptions must be signed. Otherwise, a user has to create exceptions to allow remote control via ConnectWise Control, which isn't ideal. I don't want to have to sign your app to get the payload pushed out to create the exceptions from our management software. If you signed your apps like other developers, this would be much easier for all users, like those of the Addigy and JAMF communities.

Duplicates 1

Please Implement code signing for MAC OS PKG installers.

Darrin Erickson

This has been an issue for some time and it is getting worse with the latest release of MACOS Mojave. https://control.product.connectwise.com/communities/6/topics/1974-complicated-process-required-to-control-macos-1014-mojave-clients

Security requirements are increasing and there may come a point where we cannot use ScreenConnect to manage/support Macs. If that happens, it will force us to abandon Screenconnect for managing Macs which means less revenue for you. Since you have a cert in use for the windows EXE, why not sign the PKG files for Macs with the same cert? Can someone in business development review this and get an internal count of how many hundreds or thousands or tens of thousands of machines are currently under Control? It's likely a big impact.

Thanks for your time and consideration.

Replies 101

Newest first
Newest first Oldest first

Tom R

7 years ago

As a heads up if you've signed screen connect with your own developer cert and deployed a PPPC profile this update is probably gonna break that since the app is now signed with Connectwise's cert.

Reply Link

Alex Hart

7 years ago

Quote from anonymous

v6.9.21870.6964 has been promoted to stable and is available for on-prem and cloud partners. This thread should remain open while documentation is being completed.

Make sure to update the uninstall script available at

https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Knowledge_base/Manually_remove_an_access_agent

Reply Link

Alex Hart

7 years ago

ConnectWiseControl PPPC.mobileconfig

In case anyone needs it, I've attached a .mobileconfig that you can deploy with your approved MDM/DEP solution.

Here is the outcome of deploying that:

Reply Link

Alex Hart

7 years ago

Quote from Headbolt

FYI for those that need it, here are the settings i use to allow the TCC/PPPC to work.

The Client ID does not seem to be an issue, so this should work for anyone on the new version.

I do mine in JAMF

APP

Identifier

com.screenconnect.client.access

Bundle ID

Code Requirement

identifier "com.screenconnect.client.access" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = K8M3XDZV9Y

APP or Service

Accessibility

AppleEvents

Reciever Identifier

com.apple.systemevents

Bundle ID

Reciever Code Requirements

identifier "com.apple.systemevents" and anchor apple

You should also be including /bin/bash in accessibility and appleevents

Reply Link

AMcCabe

7 years ago

Quote from Tom R

Well that's still a huge mis step on Connectwise's part. It's one additional certificate to sign the package.

Why would you go through the trouble of signing the app and not the package? What would like me to tell our customers/employees when they receive Gatekeeper warnings which can be very forbidding. And no telling them "its ok to install' is not a valid answer.

Signing the pkg without removing support for customization would be a significant undertaking (though of course you're welcome to create a separate feature request for that if it doesn't already exist).

You could also connect with a support session to begin with and then install the access agent from there; the support bundle is signed, so Gatekeeper shouldn't complain about that.

Reply Link

Tom R

7 years ago

6.9.21870.6964 now shows up in stable on the downloads page.

Reply Link

Tom R

7 years ago

Well that's still a huge mis step on Connectwise's part. It's one additional certificate to sign the package.

Reply Link

Tom R

7 years ago

Thank you. There is am issue with our license that is preventing your cloud instance from upgrading. I will get that resolved internally. The link you provided now shows 6.9.21870.6964. in pre release NOT stable. It showed neither this morning.

Reply Link

AMcCabe

7 years ago

Quote from Tom R

I just built a custom branded pkg installer (10:25 am EST 2/14/2019) from our Cloud Portal and it installed 6.9.21691.6956

Is the cloud installer only available for direct download as of now rather than through our portal?

Also will the pkg installer also be code signed now as it is not currently?

Also it is currently only listed for download at https://www.screenconnect.com/Download?result=5sdfss156d156sfsd156fsd156f

and not

https://www.connectwise.com/software/control/download

Can we have some continuity?

To clarify, the pkg itself is not signed, but the app it installs is. I don't believe we have any imminent plans to sign the pkg itself

Reply Link

anonymous

7 years ago

Quote from Tom R

I just built a custom branded pkg installer (10:25 am EST 2/14/2019) from our Cloud Portal and it installed 6.9.21691.6956

Is the cloud installer only available for direct download as of now rather than through our portal?

Also will the pkg installer also be code signed now as it is not currently?

Also it is currently only listed for download at https://www.screenconnect.com/Download?result=5sdfss156d156sfsd156fsd156f

and not

https://www.connectwise.com/software/control/download

Can we have some continuity?

Verify that your cloud instance has been upgraded to 6.9.21870.6964. Every client installer is downloaded from a particular instance
The pkg access client is signed
You are able to download 6.9.21870.6964 stable from https://www.connectwise.com/software/control/download

Reply Link