We have a web-site using a SSL certificate which is used for signing the profile.
After upgrading to iOS 6 we get "Not Verified" in spite of the fact that browser consider the SSL certificate trusted.
The certificate is of the type "*.host.org".
I'm not alone....
http://stackoverflow.com/questions/12503057/profiles-installed-by-mdm-service-ar e-showing-as-not-verified-after-upgrading?rq=1
Cheers
Anders
iPhone 4S, iOS 6
I have exactly the same problem. Everything worked well on iOS5.
I have included all the chain GeoTrust Global Certificate -> RapidSSL.
It seems GeoTrust is no more trusted by Apple... and the list of trusted CA for iOS6 is not available.
Can someone help ?
I did the same as you and it worked. It seems that the intermediate CAs are not available in iOS 6. When I added the RapdSSL to our own cert in the signature it worked as expected again. It seems logical as well, there is no point for an OS vendor incorporating intermediate CAs.
Well, I must have misdone something because it still not working for me.
I use a .crt including RapidSSL and GeoTrust in my own cert in the signature. (I did the same for iOS5).
Can you explain me the steps you followed ?
Yeah, I can understand that Apple do not want to incorporate intermediate CAs, but they could have tell us they will no more incorporate them.
Since the browser considers the same certificate as trusted I assumed it is because GeoTrust is still a valid CA and that the web-server provides the immediate CAs in its response as well.
Regarding the profile, I'm in the position where I create the signature myself so I only had to add all but the root of the path to get it to work. Do you have a sample profile so that you using an ASN.1-tool can verify that your SW indeed inserts the proper certificates in the CMS/PKCS #7 package?
You must be right about the GeoTrust.
I'm in position where I create the signature myself too. I use the openssl lib, and the command is the following :
openssl smime -sign -signer #{crt_path} -inkey #{private_key_path} -nodetach -outform der -in #{file_to_sign_path} -out #{file_signed_path} -passin pass:'#{$webclip_signing_password}
In my "crt_path", I have a my_file.crt which include my crt, RapidSSL crt and GeoTrust Global crt.
I don't know how to use such a tool to verify my SW. Thanks for your advices.
I didn't add the root. Isn't GeoTrust the root?
This command could be of some use as well
http://www.openssl.org/docs/apps/asn1parse.html
Good luck!
Anders
Thank you Anders.
Yes, GeoTrust is the root.
I tried with the command, and nothing strange appears. Everything seems to be ok, but I still get the "not verified" message...
Chris
If you want you could send the profile unless you can publish it somewhere which would be even better. You did remove the root?
Anders
<Email Edited By Host>
Thank you very much Anders.
Finaly, I found out the problem :
-> I added the whole chain in my .crt file, but I did not use it to sign the profile.
-> I had forgot the -certfile in my openssl command.
Sorry for the noise, and thanks again for your precious help.
Profile Install says "Not Verified" after iOS 6 Upgrade
