iOS 4 Mail and self-signed certificates

I'm having the same problem here with my company's self-signed mail server. No problems with my 3GS iPhone until yesterday's update to 4.2.1. Now, every time I send or receive mail after waking the phone I'm prompted to Accept, Cancel or Continue. Choosing Accept or Continue doesn't permanently change anything--the dialog appears the next time the phone is woken up for mail.

I just downloaded the iPhone Configuration Utility to see if there's a way to fix this.

-Terry

I'm interested in hearing how it worked out.

Although, having to use the configuration utility is absolutely not a workaround for most people. 😟 I don't even think that I can use it, because there is no .csr file to import. I'm using Courier-IMAP and it has its own certificate generating tool - http://www.courier-mta.org/mkimapdcert.html

I have tried to understand a bit more on this, installed iPhone Configuration Utility, but it seems a bit complex. I tried to create a profile, installed it, but it didn't seem to work. It probably didn't help that the email account I created through this was already set up on my phone, but still, it didn't actually seem to work anyway. If anything, it looks like it's corrupted the rest of the working accounts. By the look of it, I am now bound to having to delete all my accounts yet again and recreate them, for the third time in two days. Surely there should be some fix to this.

Yup, I'd say iOS 4.2.1 broke SSL email usability in general (relative to iOS 4.1, in which it worked fine) . Apple should issue a more meaningful popup that allows you to do all the proper things related to Certificate Trust. Specifically, when any newly opened SSL connection has an invalid certificate the user should be presented with, at least

(1) Cancel this operation
(2) Continue this operation anyway for now, but do NOT save this exception (aka "trust this certificate for right now only")
(3) Continue this operation AND save this exception permanently (aka "trust this certificate until I say otherwise")

Additionally it probably makes sense for Apple to show:

(4) Show me more details about this certificate

In iOS 4.1 (and probably previous versions) Apple was showing #1, #4, and #3 (the popup showed "Cancel" "Details" and "Continue" respectively and in that order). With the release of iOS 4.2.1 Apple has swapped the middle option from #3 to #2, so even though it still says "Cancel" "Details" and "Continue," the option for "Continue" now does something less and different! To be fair, the message in the popup is and has always been more appropriate for option #2 since it doesn't explicitly say anything about saving the exception permanently, which fairly closely follows the paradigm just about every other comparable application uses (Firefox, Webkit, Mail.app, etc). In my opinion it was a bit of a security mistake previously since some poor users might just hit "continue" and not realize they've somewhat permanently exposed themselves (presumably until the untrusted certificate expires or changes).

Of course, option #3 also opens the door to the fact that there should be a way for users to remove/add/change trust for saved certificates, just like there is in OSX (you can get to saved certificates via the Keychain.app). Importantly this feature needs to exist on the phone, not as a separate application for corporate/enterprise IT people to manage profiles.

I also checked Mobile Safari and it seems to exhibit the same new (annoying) switch from option #3 to #2.

Multiple punctuation and minor grammatical fixes

I found this solution: http://nsayer.blogspot.com/2009/01/iphone-supports-alternate-ca-root-keys.html

This allows you to install your own self-signed cert's root ca as an iOS profile, after which all your certs using the same root would be trusted. Trick is in generating your own root ca for use in this profile.

Great idea, i think i find a way to reslove the annoying thing, download the self-signed and send it as attatchment to your email that iPhone could recevie it, when you receive the email on you iPhone, check the attachment, then install it.

All of you who pretend to know whats wrong, you dont. This problem has been elevated to Apple Engineering as this is a OS bug in the email system. Also the fact that you cant throw away emails to the trash as well has been elevated

Peter, please read the entire thread. Others have tried that (in fact, there's an entire post about it!) and it has not resolved the issue. Please do not present that as a solution.

The iPhone Configuration Utility is not a feasible option for most end users anyway. It's also not possible with certain mail setups. (Courier is an example, and I have found it to be a pain on even Mac OS X Server, which lets you click a couple times and generate a self-signed certificate)

Apple needs to address this and soon. As another person mentioned, it's hosing mail, web, and iCal for people.

Dr_Stein wrote:
No. The cert is not expired and has no other errors. ONLY "MobileMail" on iOS 4.2.1 is affected by this. Everything worked fine before the 4.2.1 update.

The exact error is: "Cannot verify server identity. MobileMail can't verify the identity of "my.mail.server". Would you like to continue anyway? Cancel/Details/Continue"

Weird that I'm using a self-signed cert and not seeing this error myself on three iP4s accessing my linux box. The name on my cert matches my email box domain name - I wonder if that matters or not.

Sorry for hammering on this still, but I still don't see why my self signed certs work and yours (and lots of peoples) don't.

So, your mail server resolves correctly using the name on the cert, when accessed over 3g (ie, its the exact same name used in mail settings?)

Dr_Stein, I'm sorry that the solution I presented didn't work for you. It did, however work for me, and it could work for others.

There are others reading the forums who can benefit from various approaches. Please consider being a little more considerate to those spending time to try and help. Don't take your frustration out on me.

I agree that the iPhone util isn't feasible for most people, hence why I said that in the first line of my post.

Another note (for those who do want to try using the iPhone util) is that you have to make sure you push the right SSL cert on to your iPhone. It must be the CA signing cert, not the actual SSL cert presented to the iPhone on SSL negotiation.

OK, what is the best place to report this bug so we can get a critical mass of people to get it fixed???

It also seems to be causing the inadvertent effect of sending any reply email you are in the process of typing (when the dialog box pops up). My ISP uses a self signed certificate, and this is a huge headache.

Jeffrey

We can skip the lecture on forum etiquette. I'm quite considerate, but I (along with others) are VERY disappointed in having an update that causes unexpected problems.

According to a couple iOS app developer friends, this behavior was NOT present in the developer builds.
Nobody seems to know when exactly it popped up and why. It's as if the "Accept" button that is displayed should permanently store the exception but just fails to do so.

Accept on self-signed certs was never permanent on websites though. The proper fix Apple should do is a 3rd "Always trust" button while "Accept" is one time only like currently. This is standard browser behaviour, and an always trusted cert should work for both safari and mail.

Message was edited by: Garrrlic