iOS9 prompting for SSL Client certificate every time

Question

Level 1

1 points

iOS9 prompting for SSL Client certificate every time

Hi,

I've just updated an iPad to iOS9, and noticed what looks like a change of behaviour in the way iOS handles SSL Client certificate requests.

I have a homescreen bookmark, which launches a website which prompts for client certificate authentication. In iOS8, the first time you chose which certificate to use (there's only one valid on the device in this case), and then each time you launch the app, it would automatically use that certificate.

Since upgrading to iOS9 - it now prompts (TWICE) every time the app/bookmark is opened, which is a total pain!

Nothing mentioned in the release notes about this which is just typical, is it an undocumented change and/or is there a workaround for it?

Thanks

iPad 2, iOS 9

Posted on Sep 17, 2015 4:12 AM

Reply

Answer 1

MMax92p Author

Level 1

1 points

Sep 18, 2015 1:41 AM in response to MMax92p

Have tried phoning Apple Support - but there's no chance in **** I'm paying 25GBP just to speak to someone who'll probably have no concept what an SSL Certificate is, let alone how to fix the issue!

Looking at the forums this was reported back in iOS5 and iOS6 as well - apparently 5 broke it, 6 fixed it... looks like we might have to wait for iOS10 to get an actual fix!? **** apple, this doesn't just work!

Reply

Answer 2

MMax92p Author

Level 1

1 points

Sep 18, 2015 2:28 AM in response to MMax92p

Further testing carried out - I have upgraded a non MDM managed iPad, and the same issues affects that one too. I suspected there might be a profile conflict due to the same CA certificate signing the profile as well as the SSL Client Certificate, this is not the case.

Reading around, https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1129#VulnChangeHistory Div

About the security content of iOS 9 - Apple Support

This might be the root cause:

"Description: An issue existed in Safari's client certificate matching for SSL authentication. This issue was addressed through improved matching of valid client certificates."

So, how it's "improved matching" works, and how to make sure it works as you wish it to, seems to be a typical blackbox?

Any devs out there with experience of this?

Thanks

Reply

Answer 3

Sep 22, 2015 10:50 AM in response to MMax92p

Experienced the same issue. Only one client certificate is prompted for one time. But there's only one certificate to select from so the prompt does not make sense IMHO.

Anyone else experienced this? Any workarounds?

Many thanks

Jens

Reply

Answer 4

Sep 30, 2015 8:41 AM in response to Jens Schwendemann

The only workaround I've found is to use Safari instead of the home screen web app. Safari only prompted me once and remembered the choice on subsequent page loads. I submitted a bug report to Apple on Sep 17th and it was closed as a duplicate of 22378507. So they are at least aware of it.

Reply

Answer 5

Oct 4, 2015 10:08 AM in response to jmcox1027

Thanks for the details. This worked so well in iOS 8 and now getting constantly the two popups when starting our frequently used web app. The Safari workaround works but is not as convenient as the home screen web app (if it worked without the prompts). I hoped this would be fixed with the next update but iOS 9.0.2 still shows the same issue. Does anybody have an update of the status of bug 22378507?

Reply

Answer 6

MMax92p Author

Level 1

1 points

Oct 5, 2015 1:30 AM in response to MartinPAD

I have just tried logging into https://bugreport.apple.com/logon to check - but that's just stuck in a redirect loop back to the login page, it doesn't error - just doesn't log me in?

Stuck, in the dark, like mushrooms

Reply

Answer 7

Oct 6, 2015 1:41 AM in response to MartinPAD

I opened a Bug report for this and would encourage anybody that finds this behavioir anyoing to do the same to raise pressure on Apple.

That being said it seems that Apple is indeed aware of the issue and tries to mitigate impact on the user experience. In 9.1 beta 3 there's now only one popup where you can chose your (single) certificate and also cance the process. So we're down from two unneccessary popups to 1 unneccessary popup.

My guts feeling is that having this popup is a (bad) way to workaround some security issues they have with certificates. If anybody from Apple could clarify on this, would be highly appreciated.

Edit: I installed beta 3, so I corrected that in the above text. Not sure if new behavior is already available in beta 2, so YMMV

Cheers

Jens

Reply

Answer 8

MMax92p Author

Level 1

1 points

Oct 6, 2015 1:38 AM in response to Jens Schwendemann

Thanks for your input Jens, that's appreciated.

I have installed 9.0.2 on several devices yesterday, and can indeed confirm in that version you still have the two popups, when launched from the home screen icon. Using Safari does indeed only prompt the once.

I have tried re-creating the homescreen link too, just in case, but that didn't change anything.

I had looked into this from an SSL perspective too. I wasn't sure if the certificate had to exactly match some advance usage, such as Subject Alternative Names (SAN) or perhaps specific enhanced key usage identifiers. I have not been able to find any useful documentation, from apple or otherwise, which would indicate any actual fix to this from a certificate perspective.

Perhaps the reason this was changed was to prevent malicious sites requesting client identification, and the browser automatically sending the certificate details. That said, if you have two certificates issues off the same CA (which I do), then surely WebKit could simply match up the SN of the issuer, and confirm that the site requesting authentication is somehow trusted? It could even match the site certificate itself against a profile certificate on the device, but even importing that doesn't change the behaviour of the browser.

Reply

Answer 9

Oct 14, 2015 7:27 AM in response to MMax92p

We're having the same issue, but with one interesting difference: we never had to choose the cert prior to iOS 9 - the devices would auto-detect them. Our company uses certs on our iOS devices to let our users access our company intranet and Oracle. Prior to iOS 9, the pages would simply render, as the device obviously auto-detected the cert. Now we have to manually select the cert on the first instance of both (intranet & Oracle). It does seem to remember them after the fact, unless the device is wiped or the cookies are cleared from Safari.

Since you're saying you had to select the cert once and how have to select twice - it seems that they definitely added something extra to the mix. Hopefully they're working on getting it fixed soon.

Reply

Answer 10

Oct 14, 2015 7:44 AM in response to MMax92p

Thanks for your further remarks on the topic.

I also suspected that there might be some (minor) mismatch between the certificate stored on the device and the configuration of the server requesting it but to no avail so far.

I also cross checked with another client certificate (actually a sap.com SSO certificate for use of their customer support center) with the same result. The certificate gets prompted for selection, even as there's only one matching cert on the devices.

What really bugs me big time is the fact that (much as usually) you don't get any details why that pop-up was introduced in the first time and whether there might be situations where (in a controlled environment - read "your own server, your own devices, your own certificates") you could configure the server / devices / certificates alike so that the popup might be surpressed.

But alas, seems like Apple is giving love to "Enterprise" pretty much boils down to get your developer account paid.

But enough for the rant, hope this gets fixed sooner or later as I still believe it's a massive disruption of the user interface flow.

Cheers

Jens

Reply

Answer 11

Oct 14, 2015 7:46 AM in response to triangle_choke

Just to clarify: We also did'nt have to chose the certificate before iOS 9. I only figured that between 9.0.2 and 9.1 beta 3 Apple did something the way the popup is displayed.

Before 9.1 beta 3 there are 2 popups, after 9.1 beta 3 there's a single combined popup where you could chose your certificate and abort in one single popup.

I hope that shed some light into this.

Cheers

Jens

Reply

Answer 12

Oct 14, 2015 8:24 AM in response to Jens Schwendemann

****. I was hoping you had to select a cert prior as well. At least, that would give me some hope that the fix from two to one that you're seeing would have meant going from one to zero for me. A man can still dream, I suppose... 😉

Reply