Configure FileVault using PRK

The purpose of this document is to describe best practices to create encryption and decryption certificates to enable filevault setup.
This implementation assumes that the administrator knows how to apply this configuration to the devices using a Policy in step C. Following these best practices, admins can successfully create and manage FileVault encryption and decryption certificates. This will facilitate the setup of FileVault, improving the security of their organization's data.
 

A. Create Encryption and Decryption Certificates. 

1. Launch “Keychain Access,” open the menu, and navigate to “Certificate assistant | Create a certificate.”

2. Name the certificate, use “identity type: Self Signed Root” and “certificate type: SSL Server,” then click create.

   

3. In Keychain Access, go to “System” and search for the certificate recently created. You will see a “private key” and a “public key” associated with that certificate.
4. Highlight the certificate and the “public key”, right-click on both and select “export 2 items…” Name this as public and select “.cer” file format.

   

5. Highlight the certificate and the “private key”, right-click on both and select “export 2 items…” Name this as public and select “.p12” file format.

   

6. When exporting the private key, a password will be required for the export. Remember this password as it will be necessary when importing the certificate to KACE Cloud.

   

 

B. Import the Certificates to KACE Cloud. 

1. Go to "Libraries | Certificates | Add New" and import the public key first.

   

2. Repeat the above step when importing the private key, and remember to import the password from the export steps.

   

3. Then go to "Libraries | Security | Add New | FileVault Configuration"

   

• Mark the option "Use a personal recovery key" then mark "Report device's personal recovery key during inventory" and add a message to the users.
• "Add personal recovery key encryption certificate" map the public key.
• "Allow KACE Cloud to decrypt personal recovery key" map the private key. (this is optional, if the key is not mapped, admins can use third-party tools for decryption)
• The rest of the options in yellow are optional for the admins.

 

C. Review Setup. 

After deploying this using a Policy on a test device, if this has been set up correctly, the device encryption job can be started.
Remember to reboot the device and force inventory after FileVault encryption completes.
The recovery key can be found under "Devices | Select a device | Summary | Security box."