IOS prompts for a client certificate each time i change webpages on a site

Question

Level 1

0 points

IOS prompts for a client certificate each time i change webpages on a site

The company intranet is published through a TMG 2010 box and we use client certificates as an extra level of authentication in addition to AD user / pass.

With any PC based browser you are prompted once for the certificate to use, however in IOS 5.1.1 on iphone and ipad we get a prompt each time you go to a new page, safari prompts for the certificate to use however the more times you change the page the more it relists the certificate in the selection window. The certificate you see in the screen shot is installed once. The first time I change the page, safari reprompts and lists 2 certificates (both the same) next time i change the page it then lists the certificate 3, then 4 then 5 times etc. The client certificate is issued directly from the root CA so this isnt the issue of IOS not supporting 2 or 3 tier certificates.

All other PC based browsers work fine and only prompt once then happily reuse that certificate when you change pages without reprompting.

iPhone 4, iOS 5.1.1

Posted on Sep 3, 2012 6:43 PM

Reply

Answer 1

smlang

Level 1

10 points

Oct 10, 2012 12:58 PM in response to Matt_1203

We're experiencing the same problem. We are also publishing internal web applications via TMG 2010, using forms based authentication with client SSL certificate authentication.

We see this problem on devices using iOS 5.1.1. Devices with iOS 6 are automatically selecting the client certificate. Unfortunately upgrading to iOS 6 is currently not an option.

Reply

Answer 2

smlang

Level 1

10 points

Oct 12, 2012 2:15 AM in response to smlang

It seems the iOS device is starting a new SSL session on each page request. Session ID is set to null on "Client Hello". This results in the exchange of server and client certificates on each page request. Still in the dark as to why this is happening.

Reply

Answer 3

Matt_1203 Author

Level 1

0 points

Oct 14, 2012 9:42 PM in response to smlang

IOS 6 did indeed fix the issue,and we will upgrade devices since there wont be any further updates to IOS 5 that may resolve it. smlang if you manage to resolve it not using the correct session ID then it would be good to hear how.

Reply