How to add a .crt certificate to iPhone's keychain?

Question

I moved a .crt certificate file onto my iPhone device via Dropbox and tried following these instructions to add it to the device keychain:

It suggests to open the certificate file but my iPhone doesn't know what to open the .crt with?

How should I proceed from here to add the certificate to my keychain?

Answer 1

Updated for iOS 12.0.1

As Andrew and Michal mentioned, apparently iOS only allows the Mail and Safari apps to open and install certificates. Other apps are blocked from opening certificates.

So here is how I got mine working:

1. Put my certificate file (mycertificate.crt) on my private local server temporarily.
2. Using iOS Safari (very important), browse to my https://mylocalsite.test/mycertificate.crt
3. You'll probably see a "This Connection Is Not Private" warning and need to click "Show Details" > "visit this website".
4. When prompted with "This website is trying to open Settings to show you a configuration profile. Do you want to allow this? [Ignore or Allow?]", choose "Allow".
5. You'll now be in your iPhone Settings > Install Profile. Click "Install" to install the certificate.
6. Enter your passcode to confirm.
7. You'll see a warning telling you "This certificate will not be trusted for websites until you enable it in Certificate Trust Settings." Press "Install" to proceed.
8. Press "Done".
9. Visit Settings > General > About > Certificate Trust Settings
10. "Enable full trust for root certificates" for the newly-installed certificate.
11. (Restarting the phone does not seem to be necessary.) I was immediately able to use Chrome to browse to my site using https, and it worked as I hoped.

These other links helped me, too:

• https://support.apple.com/en-us/HT204477
• https://support.securly.com/hc/en-us/articles/206978437-How-to-deploy-Securly-SSL-certificate-to-iOS-
• For generating a local Certificate Authority and self-signed certificate, my favorite approach as of 2020-09-14 is https://github.com/FiloSottile/mkcert

Answer 2

Copied from the site you linked

If you wish to use your certificate for S/MIME after you have followed this guide, please visit https://support.quovadisglobal.com/KB/a353/how-do-i-sign-and-encrypt-on-an-apple-iphone.aspx. Important Note: Apple recommends that a *.p12 or *.pfx file is sent to your device as an attachment in an email. QuoVadis does not recommend this approach unless email access to your mail server is encrypted using SSL.

You need to e-mail yourself the certificate, other 3PP programs are sandbox'd from accessing the iOS keychain.

Answer 3

From iOS 11, if the .crt file is in a location accessible using the Files app, then you just need to tap on it from within Files to install the certificate.

This also applies to other types of certificates supported by iOS.

Answer 4

Be advised that iOS 12 will reject root certificates that do not have a 'common name'.

https://forums.developer.apple.com/thread/89568

Also make sure the cert has Subject Type=CA or it can't be installed as a root cert to be used for https.

Answer 5

Since you're using Dropbox, you don't need a web server of your own to solve this.

1. Find the cert in the Dropbox iOS app.
2. Tap the ellipsis in the upper right and select Copy Link.
3. Open Safari, paste in the link, and go.
4. If Dropbox offers to open it in the Dropbox app, say no.
5. Click the link to Download the file.

From there on out, it's the normal steps for loading it from Mail or Safari.

Answer 6

On IOS 16.1 airdrop, email or text did not work, used free "Personal Web Server" Mac app, Thanks!