Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I recently installed two certificates (for use in signing mail) on several iOS devices. Both certificates derive from the same trust chain and were purchased from the same vendor on the same day. The only difference between them is that they are associated with different e-mail addresses. Both work fine on OS X in Mac Mail. But when they are installed on iOS devices (using iPhone Configuration Utility after exporting to .p12 files from Keychain Access) one works fine while the other is flagged as "not trusted".

What could account for this difference?


Update: 5.1 does not fix this.

share|improve this question
1  
    
That's more or less the same as apple.stackexchange.com/q/28445/9058. Combining them into one question might get better results. –  patrix Oct 19 '11 at 22:07
    
No, it's a different question entirely. –  raxacoricofallapatorius Oct 19 '11 at 22:17
1  
Have you evaluated both certs in the certificate assistant on OS X in the Keychain app? –  bmike Nov 15 '11 at 20:04
    
Those two different e-mail-accounts... Are they exchange? –  Max Ried Jun 28 '12 at 16:35
show 1 more comment

1 Answer

up vote 1 down vote accepted

Several things could be problematic.

  • the device - you can swap the certs on the devices to test that
  • time settings can cause a cert to fail to be authenticated if it uses some sort of OCSP/CRL revocation check
  • iOS being more picky than Mac and there being something technically wrong (or just not what iOS wants even if it's technically a valid cert)
  • provisioning profiles on one or both device that alters the trust policies or networking in a way that blocks some intermediate cert needed to validate the problem cert.
share|improve this answer
    
This turned out to be a bug. It's gone as of iOS 6. –  raxacoricofallapatorius Sep 20 '12 at 19:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.