Newsroom Update

Beginning in May, a special Today at Apple series titled “Made for Business” will offer small business owners and entrepreneurs free opportunities to learn how Apple products and services can support their growth and success. Learn more >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Client SSL Certificate Authentication

I'm trying to access a website which requires a client side certificate using the iPad.

Root CA cert is installed in a profile, but Safari does not ask for a certificate, even though one is installed.

Is there a way to force the identity preference on the iPad? How can I access a web site which requites a client side certificates?

Posted on Apr 23, 2010 12:17 PM

47 replies

CTX

Level 1

0 points

Jul 21, 2010 5:12 AM in response to Matevz Gacnik

http://community.citrix.com/display/xa/CitrixReceiver+foriPad - you need to download (free) the receiver for iPad and your company needs to add a small set up as per the URL to make production farm accessible via the reciever.

Runs like a dream

Zabby81

Level 1

0 points

Aug 21, 2010 1:58 PM in response to Matevz Gacnik

Any News on it?
3.2.2 and client auth via browser still Not working.... With iPad

Sep 18, 2010 8:21 PM in response to Matevz Gacnik

I have same problem, but Apple also give me an answer.
Who know more about it, please post it on.
Thanks.

Sep 22, 2010 5:04 AM in response to Matevz Gacnik

Anyone out there with access to iOS 4.2 to try this thing out?

I can't believe this is not supported, since most online BANKING scenarios use it, along with a plethora of apps.

Oct 27, 2010 9:14 AM in response to Matevz Gacnik

Same problem here. It

Nov 4, 2010 3:54 AM in response to Matevz Gacnik

iPad works well with SSL authentication if certificates used RSA-1024 key length. Certificates with longer key aren't working. It was checked with Apache 2.0 mod_ssl.

Feb 11, 2011 6:35 AM in response to Roman2011

Hi there,

Unfortunately I still have a problem maintaining an open SSL connection (RSA 1024 certificate). I am able to establish it, but at random intervals the iPad apparently terminates it and I have to provide again credentials. Worth of mentioning is that I do not experience the same issue with a 3G iPhone (iOS 4 or 4.2) when trying to access resources on the same website using the same certificate-based secure connection
Does anyone know how to fix such a problem?

Jul 4, 2011 3:45 AM in response to Matevz Gacnik

Sorry to dig this one up.

I've also got this working on an iPad running iOS 4.3.3 , however the requirements are to run 2048bit SSL.

2048bit CA and a 1024bit client certificate

A 2048bit CA and a 2048bit client certificate, Safari on the iPad showed a loading symbol that kept refreshing in some kind of loop, it never stopped.

The Apache never sees a successful connection.

However with a 1024bit CA and a 1024bit certifiate everything works fine.

Does anyone know if its possible to use Apache, mutual SSL, or SSL with a client certificate for authentication, and 2048bit SSL with an iPad?

Is there any chance the mobile Safari will be upgraded to support this in iOS 5?

The Apache version is 2.0.59, all certificates were generated using openssl on Redhat linux.

Thanks

Nov 4, 2011 2:28 AM in response to Matevz Gacnik

Hi,

I have setup the lab with IIS (Windows 2003 R2) and enabled Directory Services certificate mapping and required certificate authentication on web site.

Client Certificate Authentication works perfectly with one or more certificates on iPhone 4 (IOS 5). If you have only one certificate, mobile Safari does not ask you for certificate selection, it just authenticates you without any problem. If you have more certificates, then you have to select the wanted certificate and it works like a charm.

I am using 2048 bit RootCA key and 1024-bit and 2048-bit user certificates. It all work, so it does not depend on key lenght.

Important thing is that I am using only one level in PKI hierarhy, so only RootCA server.

In other lab, certificates are issued using 3-tier PKI hierarhy and Client Certificate authentication does not work. Mobile Safari does not ask for certificate and does not show any error message. There is only error message from IIS that this page requires certificate authentication.

It looks like that mobile Safari does not recognize certificates issued from 3-tier PKI. I did not try 2-tier PKI, will do that soon.

Any information from Apple on 3-tier PKI support?

Thanks,

Stibra

Nov 7, 2011 3:00 AM in response to Matevz Gacnik

It is interesting that iPhone works with 2-tier PKI and client certificate authentication, but iPad does not work!!!

iPad for now works only with 1-tier PKI client certificates.

Nov 7, 2011 12:53 PM in response to Stibra101

Just FYI, I was using a 2-tier PKI when I was testing with Apache.

Apple did offer there support for troublesooting the issue, as part of their enterprise support team, however the company I worked for ran out of ipads and budget 😟

Nov 8, 2011 3:15 AM in response to anAnonyUser

There is no difference between IIS and Apache, they work both. There are problems only in IOS. Interesting thing is that iPhone supports 2-tier PKI for client certificates, and iPad do not.

Any rdp or Citrix client with support for client certificate authentication?

Nov 8, 2011 3:25 PM in response to Stibra101

Sorry for error in previous post, there is no difference between iPhone and iPad, but between IOS version.

IOS 4.2 and 4.3 supports 2-tier PKI and IOS 5 DOES NOT SUPPORT 2-tier PKI. Why? Why????

oblabla

Level 1

0 points

Jan 19, 2012 6:29 AM in response to Stibra101

Dear All,

Facing the same issue with safari client certificate authentication: Was someone able to find answer to the fact that IOS 4.x was OK with 2-tier PKI hierarchy and that IOS 5.x isn't ?

Jan 19, 2012 7:38 AM in response to oblabla

Yes, after detailed testing with different certificate sizes and different PKI hierachy, IOS 4.x works fine with 2-tier, while IOS 5.x supports only 1-tier PKI.

I do not have Apple support agreement, but would like to hear something officialy from Apple about that and when they plan to implement normal behaviour and support 2 and 3-tier PKI for certificate client authentication in Safari.

Client SSL Certificate Authentication