Manage iOS devices in air-gapped environments iOS 17 and above devices require an initial online validation with Apple before they can run tests on a Mac mini host that has no Internet access. This guide applies only to Standalone/On-Prem deployments where the Mac mini host has no Internet access. How Apple validation works Apple applies two checks that determine how iOS devices behave in an air-gapped lab. Signing certificate validation Apple validates provisioning profiles and signing certificates against Apple servers the first time they are installed on a device. This validation requires Internet access once. Later launches use the result cached on the device. Personalized Developer Disk Image Each iOS 17 and above device requires a Developer Disk Image (DDI) that Apple personalizes for that specific device. Xcode requests the personalization from Apple at https://gs.apple.com/TSS and stores the signature on the device. After the signature is in place, the device no longer needs Internet access to mount the DDI. Apple can change this endpoint. Confirm the current address if the Internet Mac has restricted outbound access. Apple has not published whether a personalized DDI expires or how long it lasts in an air-gapped environment. If connection errors occur and other troubleshooting steps do not resolve the issue, the personalized DDI may have expired. Repeat the preparation process in that case. Requirements The Internet Mac: a macOS machine with Internet access and Xcode installed. Xcode on the Internet Mac at the same version as the air-gapped Mac mini host, or later. Developer Mode enabled on each iOS device. deviceConnect installed on each air-gapped Mac mini host. Physical USB access to the devices. Kobiton software, such as deviceConnect and deviceShare, does not need to be installed on the Internet Mac. Prepare a device for an air-gapped host See Preload DDI for air-gapped Mac mini hosts. The procedure covers three phases: On the Internet Mac, connect the device over USB and open Xcode so the device establishes trust, validates its certificate, and receives its personalized DDI. Copy the DDI files from the Internet Mac to the air-gapped Mac mini host. Connect the device to the air-gapped host, then restart deviceConnect services so the host mounts the DDI. Repeat the procedure for every iOS 17 and above device and every air-gapped Mac mini host in the lab. Verify the device Open Chrome on the Mac mini host, go to localhost, and sign in. Navigate to Devices. The device displays as Available. For the full verification steps, see Verify device is available in Kobiton. Troubleshooting A device that fails after preparation usually has an expired or missing credential, an unmounted DDI, or a certificate that does not cover the device. Check deviceConnect logs first. See Retrieve deviceConnect logs. Apple changes the wording of these errors between Xcode versions. Match on the behavior described below rather than on an exact message. Symptom Likely cause Action deviceControl fails to launch The signing certificate expired, or the provisioning profile does not cover the device Reconnect the device to the Internet Mac and open Xcode to revalidate the certificate. If the error persists, generate and import the correct certificate and provisioning profile. The DDI does not mount The personalization signature is missing or expired on the device Repeat the preparation procedure, then restart deviceConnect services. A new device is not recognized The device UDID is not included in the provisioning profile Generate a provisioning profile that includes the device UDID, then import it to the host.