Add certificates to host vitals for macOS, iOS, iPadOS

[noahtalerman]

Goal

User story
As an IT admin on the Host details page,
I want to see a list of certificates on my macOS, iOS, and iPadOS hosts
so that I can understand if a missing/expired certificate is the reason why an end user can't connect to the corporate network.

Objective

Mission critical MDM replacement

Original requests

• Add certificates to host vitals (macOS, Windows, Linux, iOS/iPadOS, Android) #22802

Context

• Product designer: @rachaelshaw

Changes

Product

• UI changes: Figma
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: PR
• Fleet's agent (fleetd) changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: Fleet Free
• Other reference documentation changes: No changes
• Once shipped, requester has been notified

Engineering

• Feature guide changes: CHV: Guide #25457
• Database schema migrations: CHV: DB Schema changes #25456
• Load testing: N/A

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: no
• Risk level: Low / High: Low

Manual testing steps

Host details page

1. Ensure Refetch updates certificates on host
2. Ensure Certs are listed alphabetically
3. Confirm additional macOS only text is visible (regarding Keychain)
4. Confirm Learn more link resolves
5. Ensure Expire dates are accurate
6. Ensure status indicator color matches. eg. expired, expiring, or valid
7. Ensure the new Certificates section does not appear for unsupported platforms/hosts
8. Test macOS, iPhone, & iPad
9. Test resolution & screen size support
10. Ensure Certificate Details Modal data matches Figma + Cert details

My Device page on host
12. Ensure new Certificates section appears and matches Figma
13. Confirm the Certificate details are accurate and match the Host Details page info
14. Confirm you can click the View details link

Test API responses
15. GET /api/v1/fleet/device/{token}/certificates= Lists the certificates installed on the current device.
16. GET /api/v1/fleet/hosts/:id/certificates = Retrieves the certificates installed on a host.

Testing notes

Confirmation

1. Engineer (@____): Added comment to user story confirming successful completion of QA.
2. QA (@____): Added comment to user story confirming successful completion of QA.

[noahtalerman]

Hey @georgekarrv heads up that this story is ready to spec. Can you please complete the TODOs in the "Engineering" section so we can bring this one to estimation on Weds?

Note that this story and #17700 are the last stories that won't go through the new User story review meeting before estimation.

cc @lukeheath

[lukeheath]

@noahtalerman Would you please add the last line to the user story? "So I can..." That will help give us context on why the admin wants to do this. Thanks!

[noahtalerman]

@noahtalerman Would you please add the last line to the user story? "So I can..." That will help give us context on why the admin wants to do this. Thanks!

User story
As an IT admin on the Host details page,
I want to see a list of certificates on my macOS, iOS, and iPadOS hosts
so that I can understand if a missing/expired certificate is the reason why an end user can't connect to the corporate network.

Yep! Added. @georgekarrv just a reminder that this one is ready to spec.

[noahtalerman]

@rachaelshaw reminder to include to the "so..." clause when writing user stories: #23235 (comment)

[noahtalerman]

Hey @georgekarrv just a reminder that this story is ready for spec. Can you please complete the TODOs in the "Engineering" section so we can bring this one to estimation today?

cc @rachaelshaw

[georgekarrv]

After reviewing the API spec I would not say that I agree with adding a list of certificates to the host details information (already a pretty bloated endpoint) and would recommend adding either a trimmed amount of data that is requested for this story (id, name, expiry) add total count and limit to the first 5 or make a paginated separate endpoint.

Either way I would recommend the detail endpoint be separate instead of just referencing all of the data from the host details ep.

[noahtalerman]

@georgekarrv looks like this story is estimated so I moved it to the estimated column.

[georgekarrv]

Just a reminder that this is a pre-requisite for the #24468 story and should be done in the sprint prior to working on renewing NDES

[getvictor]

To get the certificate list, we may be able to subscribe and be notified when certs change on the device. This is a more scalable approach than trying to ping the device every time for the list.

To do this, use a ManagementStatusSubscriptions DDM profile, like:

{
  "Type": "com.apple.configuration.management.status-subscriptions",
  "Payload": {
    "StatusItems": [
      {
        "Name": "security.certificate.list"
      }
    ]
  },
  "Identifier": "my.status-subscriptions"
}

[georgekarrv]

Adding P2 back since it will be prioritized over bugs