SSL Cert Fixes

src/routes/admin.js

@@ -1224,6 +1224,24 @@ router.get('/tls/ca.crt', (req, res) => {
   res.send(ca);
 });
 
+/**
+ * The same authority in DER form, for Jamf Pro and anything else built on Apple's
+ * tooling. Offered as .cer and .der because different consoles insist on
+ * different extensions for the identical bytes.
+ */
+router.get(['/tls/ca.cer', '/tls/ca.der'], (req, res) => {
+  try {
+    const der = tls.caCertificateDer();
+    if (!der) return res.status(404).send('No certificate authority has been generated yet.');
+    const ext = req.path.endsWith('.der') ? 'der' : 'cer';
+    res.setHeader('Content-Type', 'application/pkix-cert');
+    res.setHeader('Content-Disposition', `attachment; filename="visitor-signin-ca.${ext}"`);
+    res.send(der);
+  } catch (err) {
+    res.status(500).send(`Could not convert the certificate: ${err.message}`);
+  }
+});
+
 router.post('/tls/renew', requireOwner, (req, res) => {
   try {
     // A brand new CA means every kiosk device has to trust it again, so it is