A couple of weeks ago I had upgraded my personal home computer to the latest MacOS Catalina (10.15) and one of the first issues I ran into was being able to access my vCenter Server. It turned out this was due to changes to MacOS security (which is a good thing) but certainly caught me and others off guard. In fact, I spent quite some time searching online and eventually found this workaround here.
After sharing this tidbit online (which several others also ran into) I came to learn that both Duncan Epping blogged about this issue back in Nov 2019 here and Christian Mohn blogged about this in Dec 2019 here. Sadly I did not come across either of their blogs using "NET::ERR_CERT_REVOKED macos catalina" in Google. I had assumed this was a Chrome issue and simply landed on the first few links and looking back, I now see Duncan's blog was #6 in the search results (doh!)
This is again due to a security change in MacOS Catalina which now prevents terminal-based applications which are not notarized from running. For a single application/binary, you can go into System Preferences->Security & Privacy and allow anyway. For more complex applications like the VCSA CLI Installer which has a number of libraries and scripts, this will take awhile and end up frustrating end users. The updated security enhancement is actually a good thing and I did not want to disable the Gatekeeper service but I was interested in disabling it for the VCSA CLI Installer. While searching online, I came across this Hashicorp Terraform thread where folks were having the exact same issue and I found out there was a way to disable the MacOS Security Gatekeeper for a specific application.
After the quarantine attribute has been removed, you can now run the VCSA CLI Installer (including UI Installer) without being prompted with an error. Hopefully VMware will consider notarizing future releases of the VCSA Installer and I will be sharing this feedback internally if it has not already.
Another way around the Catalina SSL issue is to import the certs into your keychain. In Chrome if you view the certificate by clicking the "Not Secure" section to the left of the URL, you can then just drag the cert to your desktop, then open it by double clicking, which will open Keychain. Once in Keychain, you can set it to always trust. Saves a few steps for things that use Identity Manager as you only have to do it once instead of for each solution.
Hello! Thanks for the great tip!
I have something else I didn't search properly how to fix yet, I thought someone could have a quick fix for that.
When starting my VMs it asks for my admin password for every NIC the VMs have. Is there a way to run my VMs on a "trusted" mode? Without having to authorize them every time?
Thanks!
Hi has anyone run into similar issues when trying to install vcsa ui installer? I get ovftool cannot be opened, libcrypto.1.0.2.dylib, libvmacore.dylib cannot be opened as well even after allowing it from settings. I tried running the command line that William shared. Didn't work and tried with my current version and build number and no luck either.
over 1 year and no change the the VRA8.3 installer - same behavior. I'm sorry that they didn't hear your feedback and I'm sorry that MacOS is still a second class citizen with respect to Vmware installers. Thanks for your blog william , we appreciate your help.
William is Senior Staff Solution Architect in the VMware Cloud Foundation (VCF) Division at Broadcom. He focuses on Cloud Native, Automation, Integration and Operation for both VMware vSphere Foundation (VVF) & VMware Cloud Foundation (VCF) across Private, Hybrid and Public Cloud
I have been having the same issue for the past 24 hours. Spoken to 3 different representatives and the still has not been resolved. I have MacOS High Sierra on my Macbook Air 2017. I am trying to download to the Monterrey software, but my laptop won't even let me install it. It keeps showing Checking "null". Even when I tried installing Big Surr, it doesn't work. Please tell me there is a solution for this!
Same. I've been working on this for 3 days now. 2017 MacBook Air was loaded with Monterey, wiped, then will only successfully re-install High Sierra. Trying to load Big Sur. Haven't tried anything in between.
I have been having this same issue. Rather than try all of the above - open the applications folder, drag and drop Monterey to the trash. Open up the App Store and download Monterey that way. Took me 10 mins!
I got a solution that worked!!!if you are on high sierra or mojave, firsr install catalina by searching catalina installer and you will get a apple site link. Click catalina installer and you will be redirected to app store. Install catalina first and then you can install big sur or monterey without this null error
Save all your data as you will lose it. Use the OPTION-COMMAND-R as soon as you have pressed the start button and before the Apple Logo appears. The 4 option menu will come up and chose restore - it will then do a new installation with the current macOS (Monterey) on your selected volume (usually Macintosh HD) but you can chose any if you have more than one (ideal for test environments).
Like the previous discussion i created on Jamf Nation about upgrade paths to Mojave back in september, i thought lets start a new fresh thread for sharing macOS Catalina installing & upgrade ideas and experiences.
Modulair Imaging
We all know that "modulair" imaging is dead for a while, but to be honest for our older mac fleet that is not DEP registered and not having an T2 chip i still used Jamf Imaging and creating DMG's with AutoDMG for bringing that Mac's alive.
Upgrading
The thing i already noticed is that in the past new macOS version were available in the Mac App store. Now the Software Update pane gets an 1 icon and will give you the option to download and install the upgrade.
I heard there is a reset (or was it restore) option in system preferences in Catalina, that works like an iPad where you can reset and erase the macOS to factory settings. I am not on beta, so I can't confirm that. If Apple added this feature in Catalina, that would be better than using imaging to reset computers with fresh macOS.
First, I want to say, the utilization of the 'Download and Install' through Management command for single computer or 'Action' via the search for multiple, didn't work for me. So, I've looked at the 'whitepaper' on how to install/ upgrade to Catalina but it seems one of the easiest ones for MDM infrastructure has been omitted....The 'Mac App Store Apps' approach.
After your receive the email confirmation and Jamf Pro syncs with VPP, make sure that when you're reviewing the OS within 'Mac App Store Apps' and setting up scope, you're NOT selecting 'Site' under General tab but on the actual 'Scope' tab. Otherwise, you won't be able to assign the licenses gotten via VPP.
Said policy should execute following command (Within 'Files and Processes') '/Applications/Install macOS Catalina.app/Contents/Resources/startosinstall --agreetolicense --nointeraction' (remove the apostrophes from the command)
Side Note: I like using 'Smart Groups' in conjunction with my scopes. It eliminates keeping track what has upgraded, shouldn't be upgraded and what happens when you image it with something else. So here is what I have as criteria:
1. Enrolled via DEP -> is -> Yes
2. OS Version -> greater than -> (I have a specific need for a specific version, so that's what I have there)
3. Building -> is -> my neck of the woods
Which is a perfectly fine way to go, however I prefer the scripted approach macOS Upgrade which gives the user clear instructions on what is happening. Your method will trigger a 30second countdown timer for users before it auto restarts, which could be fine for some but others could be doing a presentation before it restarts
I'm still amazed to see imaging mentioned. I considered our school one of the last holdouts but once the APFS change happened and I read what was necessary to make it maybe work, we finally submitted to provisioning via scripts and policies. It's definitely not as set it and forget it but it works. The real disappointment was DEP. All it really does is throw it in Jamf for you. Cool, so I don't have to do a QuickAdd. Sooo much time saved. /s
@totalyscrewedup ... dude!! Why has nobody come else come up with this solution? You are awesome!!
I am going to test that option via VPP and self service.
Just wondering .. if I can scope to all machines and that app will take care the min requirements?
any one can chime in?
@txhaflaire does your script take into account Standard users performing the upgrade? I know for upgrading to Mojave, admin creds were required and there was a scripted workaround of granting temporary admin access to the user's account during the upgrade process, then revoking admin post-install.
@vcasiero Where did you download the installer app? Did you had to put it in composer before adding it to JAMF admin? I'm trying to push out Catalina via Patch Management but the package doesn't seem to work, so not sure what I'm doing wrong.
But Why? Because DEP with "Enrollment Complete" trigger isn't reliable - If I can get 75% success with that combination I'm super happy. But what if you have to make sure that everything the user needs is installed when you hand it to them? Well, now we've got a problem. Especially when users are (super busy and easily distracted) nincompoops who will go into a literal war zone without updating.
When the "Enrollment Complete" trigger is > 95% successful, we'll re-evaluate it. But we've got 58 packages, < 30 GB of apps, settings, presets, and codecs, that get installed as part of our typical machine. And the last thing I need is a producer or on-camera talent camped out between Russian, Turkish, Kurdish, and ISIS soldiers shooting at each other who can't do his job because he forgot to install something before he left the bureau. And when your only internet connection is a portable satellite terminal where downloads cost $4.35/MB and max out at 384Kbps, the last thing anyone needs is a $7,873.50 bill so someone could reinstall Premiere.
d3342ee215