Trusting Self-Signed Certificates in iOS 10

What fixed this issue from my iPhone for me was going to Settings -> General -> About -> Certificate Trust Settings, and there is a section called "ENABLE FULL TRUST FOR ROOT CERTIFICATES". Under it lists the certificate that I installed on my iPhone. Once I enabled that, I'm good to go.

sorry.. I meant the file ext.

Yes, I email the **.cer file to my email. Then open the mail app to access my email, click on the **.cer to install it.

Are you using iOS mail app or third party app ? Look at my screenshots .. I have shared

This is attachment of cer file in my email.

Fig 1

Upon Clicking the root.cer file, it switches to below screen, where i get an option to install (top-right)

Fig 2

Make sure you are using the iOS Mail App and if these option are not present, then I suggest trying install the cer file on your window/mac see if it work there. Maybe something wrong with cer file ?

Thanks for this. Have quite a few iPhones on my domain now and finding the trust option was a little obtuse. Why didn't they just put it in the profile area?

just another tidbit to those admins that have their own internal microsoft pki.

IF you go to your pki server\certsrv you can install the certificate directly without having to move files around. Domain users should be able to do this as well. In my case I go to https://mdstvvutil01/certsrv enter my domain credentials and get the following dialogue..

playapuss wrote:

An additional step is now required in iOS 10.3: You must go to General->About->Certificate Trust Settings and turn on the root CA you just installed.

Dear Apple:

Dear user: Apple won't see your request here. This is a user-to-user technical support forum, not a way to communicate with Apple engineering. Apple does not read or respond here. To get a message to Apple use https://apple.com/feedback, or if you have a developer account use the bug reporting link in the developer area.

There was a problem that was fixed in 10.3.2 (released today, May 15). See: About the security content of iOS 10.3.2 - Apple Support

Impact: Update to the certificate trust policy

Description: A certificate validation issue existed in the handling of untrusted certificates. This issue was addressed through improved user handling of trust acceptance.

I just ran into this today when I had to rotate my certificates. Here's a distilled version of what I ended up having to do to solve it:

1. Copy the self-signing CA cert to a web server. I just used a machine internal to the network that already had httpd set up but wasn't exposed to the internet (shouldn't matter with a cacert, but just in case).
2. Browse from the device to the exact url for the cert. e.g. http://myserver/cacert.pem
3. Install the profile as prompted. The will grant trust to all certificates signed by your CA. The certificate will show up in Settings->General->Profile.

The key here is that you need to use the CA certificate and not the server certificate, so that the iPhone will trust the entire certificate chain. If it only trusts the server certificate, you will still get "Not Verified" because it doesn't trust the issuing authority (your CA) for the certificate.

One word on Microsoft-generated certificates: they can be problematic. I spent hours trying to get certificates created with the older MSFT tool, MakeCert.exe, to install. Nothing I tried worked... until I setup a CA installation with OpenSSL. Once properly configured, iOS 10.3.1 was more than happy to trust this certificate. Key differences:

• Hashing (older MakeCert CA used SHA1, new uses sha512)
• Issuer data (old was just text, new matched the Subject settings)
• Subject (new included email address)
• Subject Key Identifier (not present in old)
• Key Usage (not present in old, new includes: Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86) )

I had also tried resigning the same key with a newer MakeCert.exe, but could not include all of the above settings. Posting in the hope of saving others a bunch of time...

- dennis

Hi Kevlar -

Good post. We have had an Xserve running mail for 9 years and it can't be upgrade of course. So threw it out literally after iOS 10 hit the streets. Wanted to comment on SSL. It's used for the entire transmission, not just connections. If so, users wouldn't have any idea of what was being trusted during communication. All or nothing. In terms of certs, SH1 is problematic as it's deprecated so if you running 10.6.8 you'll be issuing only SH1 certs which iOS clients won't like. It's also been problems for our developers running Mac OS 10.11 and 10.12. In fact, Apple developers were told that any code submitted for products need to be be SHA2 compliant.

If you used IIS for creating self signed certificate, it may not be accepted by iOS even it is imported.

Please read this page. You may have to create it via Open SSL

https://blog.httpwatch.com/2013/12/12/five-tips-for-using-self-signed-ssl-certif icates-with-ios/

Could you explain in further detail as to the methodology? I am apparently having the same issue mentioned in the comment to which you replied, pertaining to Trust Certificates and the inability to use Mail, iCloud, and mainly any Apple function dedicated for iOS 10.2.1, which is the version I am currently running on my iPad Air 2. I typically prefer to use Gmail, however I have other email accounts I could use if necessary.

Just for further clarification, ever since upgrading along the way from iOS 9 to iOS 10.2.1, I have experienced so many glitche, such as my iCloud and iTunes account password is requested incessantly, even once input correctly, I receive error messages about not being able to access iCloud or iCloud Drive. This has not only become annoying, it has affected my Notes, iCloud, Mail, Safari and perhaps some other pertinent daily functions. Regarding Safari, my open Tabs consistently close without reason, along with all of my History, Reading List, Favorites and Bookmarks.

For instance, if I want to send an email from the Share button from Safari, I hit the Mail button, which asks me to set up email accounts, as if I have never set those up before. Just for my own humility, I will re-enter my email accounts again and again, some which come back with a message indicating that they are already registered with the System. Otherwise, I have tried using other email accounts, which have not been registered on my iPad. At which point, I go through the hassle of setting up the email account, Save the account, I receive a message that the account has been saved, however, when I go to Share, hit the Email button, it redirects me to the same screen to set up my Email accounts.

It sounds from your Discussion thread that you are referring to this type of matter, unless I am mistaken. If so, can you please offer up some more detailed advice, as I have spent hours on the phone with Apple Support, to no avail. And, the bottom line is, as much as I know about computers and networking, I wouldn't have any idea how to access, say, Google's Gmail Trusted Root Certificate and be able to email it to myself as an attachment.

As an aside, I do operate on a Windows 10 PC as well, in case this would need to be resolved using another computer source, other than my iPad Air. Anything you could do to assist would be greatly appreciated.

Regards,

Mark Halsey

Hey Shag,

I am not sure if I had replied to you regarding this post, or to the General Discussion regarding your methods in resolving the issue pertaining to Trusted Certificates.

If not, would you mind taking a look at my Post, which was actually directed at you, since your solution seemed to be the most likely workaround.

As an aside, I am using an iPad Air 2 running, iOS 10.2.1, and the Trust Certicate, which seems to be a huge problem in these Forums, is regarding Trust Certificate Version 2016102100. I tried looking it up using Apple's List of Trusted Certificates, however, I couldn't seem to locate it and really don't know what to look for.

Thanks,

Mark Halsey

Install the self assigned cert - (you can email the cert to yourself, open the mail app and install the cert) This should install the cert under setting - general -profiles.

Then you can enable that cert - Setting -General -About - Certificate Trust settings. You should see "Enable Full Trust .."

So I have been sending the certs via my yahoo email, since I can get that on my phone. When I open the email, it is attached. When I tap on the attachment, it acts like it is loading or something, see screenshot 1 above. But it never truly allows me to "install". When I go back to settings, about, security trust....this is all that is shown. So either the cert IS installed in the background but isn't recognized or it's not installed at all. This is extremely frustrating. Android makes this very simple, not sure why Apple makes it difficult.

what format is your CA in ? I have tested with .cer and emailing to my hotmail/gmail. When I click on .cer file within the email, it directs me to install the profile and I click install. Once installed you should see the cert under setting - General - Profiles.

Then you can enable that cert - Setting -General -About - Certificate Trust settings. You should see "Enable Full Trust .."