SSL Cert Fixes

src/tls.js

@@ -225,6 +225,19 @@ export function describe() {
   };
 }
 
+/**
+ * The CA in DER form.
+ *
+ * The .crt on disk is PEM: base64 text between BEGIN/END lines. Apple's tooling,
+ * and therefore Jamf Pro's certificate payload, wants the raw binary DER instead
+ * and rejects the file on its extension. Same certificate, different wrapper.
+ */
+export function caCertificateDer() {
+  const p = paths();
+  if (!fs.existsSync(p.caCert)) return null;
+  return openssl(['x509', '-in', p.caCert, '-outform', 'der']);
+}
+
 export function caCertificate() {
   const p = paths();
   return fs.existsSync(p.caCert) ? fs.readFileSync(p.caCert) : null;