18

I moved a .crt certificate file onto my iPhone device via Dropbox and tried following these instructions to add it to the device keychain:

It suggests to open the certificate file but my iPhone doesn't know what to open the .crt with?

How should I proceed from here to add the certificate to my keychain?

Improve this question
3
  • Do you need the .crt for a specific app? If so, you can probably import it via iTunes, if you connect your phone and switch to the Apps tab and select the app
    – Kevin Grabher
    Commented Mar 11, 2014 at 19:49
  • I have my own .crt that I need to access an SSL app from the iPhone
    – amphibient
    Commented Mar 11, 2014 at 21:23
  • I just made my answer more thorough and confirmed that it works for iOS 12.0.1. If you think it looks helpful, consider marking it as the accepted answer.
    – Ryan
    Commented Apr 10, 2019 at 13:19

7 Answers 7

Reset to default
22

Updated for iOS 12.0.1

As Andrew and Michal mentioned, apparently iOS only allows the Mail and Safari apps to open and install certificates. Other apps are blocked from opening certificates.

So here is how I got mine working:

  1. Put my certificate file (mycertificate.crt) on my private local server temporarily.
  2. Using iOS Safari (very important), browse to my https://mylocalsite.test/mycertificate.crt
  3. You'll probably see a "This Connection Is Not Private" warning and need to click "Show Details" > "visit this website".
  4. When prompted with "This website is trying to open Settings to show you a configuration profile. Do you want to allow this? [Ignore or Allow?]", choose "Allow".
  5. You'll now be in your iPhone Settings > Install Profile. Click "Install" to install the certificate.
  6. Enter your passcode to confirm.
  7. You'll see a warning telling you "This certificate will not be trusted for websites until you enable it in Certificate Trust Settings." Press "Install" to proceed.
  8. Press "Done".
  9. Visit Settings > General > About > Certificate Trust Settings
  10. "Enable full trust for root certificates" for the newly-installed certificate.
  11. (Restarting the phone does not seem to be necessary.) I was immediately able to use Chrome to browse to my site using https, and it worked as I hoped.

These other links helped me, too:

Improve this answer
2
  • 1
    Is it meant to install as a 'Configuration Profile'? That doesn't make sense - or is this just some dumb Apple name for a root cert?
    – Simon_Weaver
    Commented Jan 21, 2019 at 7:38
  • @Simon_Weaver, the latter.
    – Sai Manoj Kumar Yadlapati
    Commented Mar 5, 2020 at 10:38
5

Copied from the site you linked

If you wish to use your certificate for S/MIME after you have followed this guide, please visit https://support.quovadisglobal.com/KB/a353/how-do-i-sign-and-encrypt-on-an-apple-iphone.aspx. Important Note: Apple recommends that a *.p12 or *.pfx file is sent to your device as an attachment in an email. QuoVadis does not recommend this approach unless email access to your mail server is encrypted using SSL.

You need to e-mail yourself the certificate, other 3PP programs are sandbox'd from accessing the iOS keychain.

Improve this answer
5

From iOS 11, if the .crt file is in a location accessible using the Files app, then you just need to tap on it from within Files to install the certificate.

This also applies to other types of certificates supported by iOS.

Improve this answer
3
  • 1
    This worked for me, I uploaded a .crt file to Icloud Drive, where I could install the certificate. I uploaded it first to Onedrive.. that is borderline lock-in by Apple to have such restrictions in MIME type.
    – Tore Aurstad
    Commented Sep 11, 2018 at 22:13
  • 1
    Didn't work for .pfx
    – fjch1997
    Commented Dec 22, 2018 at 18:56
  • I use this method mainly with .pfx certificates, and it works for me.
    – molgar
    Commented Jan 4, 2019 at 20:22
3

Be advised that iOS 12 will reject root certificates that do not have a 'common name'.

https://forums.developer.apple.com/thread/89568

Also make sure the cert has Subject Type=CA or it can't be installed as a root cert to be used for https.

Improve this answer
1

Since you're using Dropbox, you don't need a web server of your own to solve this.

  1. Find the cert in the Dropbox iOS app.
  2. Tap the ellipsis in the upper right and select Copy Link.
  3. Open Safari, paste in the link, and go.
  4. If Dropbox offers to open it in the Dropbox app, say no.
  5. Click the link to Download the file.

From there on out, it's the normal steps for loading it from Mail or Safari.

Improve this answer
1

On IOS 16.1 airdrop, email or text did not work, used free "Personal Web Server" Mac app, Thanks!

Improve this answer
0
0

AirDrop works for this, at least on iOS 17.4.1, where I just tested it. Either aldude's answer is outdated, or he missed a step:

  1. Drag the *.crt file from Finder on a Mac to the AirDrop item in the sidebar, wait for the iOS device's icon to appear, then drop it there.

  2. If you have an Apple Watch paired with your iOS device, it will ask where you want the certificate installed. After making your selection, you should see this popup:

    profile downloaded

  3. In Settings, you should find a new "Profile Downloaded" item near the top, under your iCloud info. Click it, then click "Install" in the upper right corner of the resulting screen.

  4. Here's the tricky step: At this point, iOS knows about the CA certificate, but it doesn't yet trust it! You have to go into Settings → General → About, then scroll all the way down to the bottom to find the "Certificate Trust Settings" item. There you will find your newly installed CA under the "Enable Full Trust for Root Certificates" heading, with a toggle button to the right. Enable it.

They couldn't make it easy, could they? 😛

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .