Deploying Bitdefender using Addigy

Addigy supports silent, automated deployment of Bitdefender Endpoint Security to managed Mac devices using Smart Software. This guide covers downloading the installer from the GravityZone portal, configuring the Smart Software item, and setting up the required Device Settings (MDM Profiles) for a fully automated deployment.

Prerequisites

Before you begin, make sure you have the following:

• Access to the Bitdefender GravityZone portal
• Familiarity with Smart Software — see Creating Smart Software if you haven't set one up before

How to Deploy Bitdefender

Step 1: Download the Installer from GravityZone

1. Log in to the Bitdefender GravityZone portal and navigate to Network > Packages.
2. Click the Download button at the top of the page and select the appropriate macOS kit for your fleet:
   • macOS kit (Intel x86) — for Intel-based Macs
   • macOS kit (Apple M Series) — for Apple Silicon Macs

Note: Check which processor architecture your managed devices use before downloading. If you manage a mixed fleet, you may need to create separate Smart Software items for each architecture.

Note: When creating your installation package in GravityZone, make sure to set an uninstall password and save it before proceeding. You will need it when setting up the SSL Certificate profile in Section 3.

3. Open the downloaded .dmg file and copy the following two files to a location of your choice:
   • antivirus_for_mac.pkg
   • installer.xml

Step 2: Create the Smart Software Item

1. In Addigy, navigate to Catalog > Smart Software > New.
2. Upload both the .pkg and .xml files as Installation Files.
3. Click the Add button in the Install Command column next to the .pkg file. Addigy will automatically generate the installation command.
4. Optionally, add a Condition for Install to auto-remediate devices where Bitdefender is missing or was removed.
5. Save the Smart Software item to your Catalog. 

Tip: We recommend deploying Smart Software items to test devices or virtual machines first to verify accuracy before pushing to production.

How to Add the Required Device Settings (MDM Profiles)

Bitdefender requires several Device Settings (MDM Profiles) to grant the necessary system permissions for a fully automated deployment. Create each profile in Catalog > Device Settings before deploying the Smart Software item.

Important: Device Settings must be installed on a device before the Smart Software item runs. When added to a policy, this happens automatically based on default Installation Priority. If installing on an individual device via GoLive, deploy the Device Settings first.

1. PPPC Profile (Full Disk Access)

This profile silently grants Bitdefender the permissions it needs to operate without prompting the end user. For instructions on creating a PPPC profile, see How to Create a PPPC Payload for Full Disk Access.

Add the following four entries to the profile, enabling Access to Protected Files, Access to System Admin Files, Access to File Provider, and Access to Desktop Folder for each:

2. System Extension Profile

Bitdefender's Team ID is GUNFMW623Y. Adding this Team ID to the Allowed Team Identifiers field of a System Extension profile will whitelist all Bitdefender extensions automatically. See Allow System Extensions with Addigy MDM.

Configure the following:

• Enable Allowed Team Identifiers: Enabled
• Team ID: GUNFMW623Y

3. SSL Certificate Profile

Bitdefender requires a custom SSL certificate to be trusted on managed devices for its network inspection features to function correctly. This certificate is generated using Terminal and deployed via both an MDM Certificate profile and a Smart Software package in Addigy.

1. Use the installation package you created in Step 1: Download the Installer from GravityZone above. If you haven't set an uninstall password on that package, go back and set one now see this section, it's required for the next steps.

2. In Terminal, create a PEM certificate with a unique CN. The value for CN must differ from "Bitdefender CA SSL":

   /usr/bin/openssl req -new -days 1825 -nodes -x509 -subj '/C=RO/ST=Bucharest/L=Bucharest/O=Endpoint/CN=YourCertName CA SSL' -keyout rootCA.key -out rootCA.pem

3. Create an MD5 hash of the uninstall password set in step 1:

   md5 -s password

4. Using the PEM and KEY files from step 2, generate the PFX certificate. The filename must be certificate.pfx. When prompted for a password, enter the MD5 hash from step 3:

   openssl pkcs12 -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -export -macalg sha1 -inkey rootCA.key -in rootCA.pem -export -out certificate.pfx

5. Both of the following are required to deploy the certificate correctly:

   - Navigate to Catalog > Device Settings in Addigy and create a new Certificate profile. Upload certificate.pfx and save it to your Catalog. Note: the filename uploaded here can be anything.

   - Create a Smart Software package and upload certificate.pfx as the installation file. Use the following install script to place the certificate in the correct location. Note: the filename on disk must remain certificate.pfx or Bitdefender will not recognize it. Set this Smart Software item's Installation Priority to 7 or 8. Smart Software items default to priority 10 and Device Settings default to priority 9, so a priority of 7–8 ensures the certificate package installs before the main Bitdefender Smart Software package.

   mkdir -p /Library/DeployCert
   mv "/Library/Addigy/ansible/packages/Deploy Bitdefender Certificate (1.0)/certificate.pfx" /Library/DeployCert/
   chmod -x /Library/DeployCert
   chmod +w /Library/DeployCert

4. Web Content Filter Profile

This profile enables Bitdefender's network filtering extension. Navigate to Catalog > Device Settings, create a new Web Content Filter profile, and configure it with the following settings:

• Filter Type: Plug-In
• User Defined Name: Bitdefender
• Plugin Bundle ID: com.bitdefender.epsecurity.BDLDaemonApp
• Filter WebKit Traffic: Disabled
• Enable Filter Socket Traffic: Enabled
  • Bundle Identifier: com.bitdefender.cst.net.dci.dci-networkextension
  • Designated Requirement: anchor apple generic and identifier "com.bitdefender.cst.net.dci.dci-networkextension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = GUNFMW623Y)

Frequently Asked Questions

Do I need separate Smart Software items for Intel and Apple Silicon devices?

Yes, if you manage a mixed fleet. Bitdefender provides separate macOS kits for Intel and Apple Silicon devices. Create one Smart Software item per architecture and assign each to the appropriate policy.

What's the correct order of operations when deploying to individual devices?

This deployment uses two Smart Software items — the certificate deployment package and the main Bitdefender package — in addition to the required Device Settings.

When using GoLive to deploy to a single device, install the Device Settings and the certificate deployment package first, then run the main Bitdefender package last. The order between Device Settings and the certificate package doesn't matter, only that both finish before the main Bitdefender package runs.

In a policy, this ordering is handled automatically by Installation Priority: Device Settings default to priority 9, and the main Bitdefender package defaults to priority 10. Set the certificate package's priority to 7 or 8 so it also installs ahead of the main Bitdefender package.
 

The SSL certificate is not landing on the device after deployment. What do I do?

To verify the certificate was deployed correctly, run the following on the affected device:

security find-certificate -a -p /Library/Keychains/System.keychain

This will list all certificates in the System Keychain. Your Bitdefender certificate name should appear in the output. If it does not, confirm that both the MDM Certificate profile and the Smart Software package from Section 3 have been deployed to the device, and that the filename on disk is exactly certificate.pfx.

Related Articles

• Smart Software Overview
• How to Create a PPPC Payload for Full Disk Access
• Allow System Extensions with Addigy MDM