Recently, I want to capture the ingress package in iOS, after I installed p12 using Safari. It shows can't establish secure link.
However after I add NSAppTransportSecurity/NSAllowsArbitraryLoads = True to ingress.app/info.plist. Ingress tries send package again and again. However the server only returns null package.
In the other hands. I tried to add the p12 to OSX and pip doesn't work fine, says cert error.
I think some app only trust the default TrustStore.

So here is my problem: How to add an CA to the default TrustStore in OSX and iOS.

Finally I found an old way to add cert to default Trust Store from [question]: https://stackoverflow.com/questions/347690/iphone-truststore-ca-certificates @Max Ried's method, however it's too old, and the TrustStore.sqite has been changed into the certsTable.data and I found no way to decode it, and Russian pdf might help [pdf]: http://dsec.ru/upload/medialibrary/b2f/b2fa8c121cc7f1ca94b63f34c22735e7.pdf
So is there any up-to-date method to install CA?


Both iOS and OS X can use configuration profiles to install certificates.

Apple has some nice documentation at https://help.apple.com/serverapp/mac/5.0/#/ for how to do that using Server.app. Luckily, you can use the same profile on iOS/OS X for certs although many other settings are unique to one or the other OS.

I would recommend using Apple Configurator 2 to make your profiles since it's free and graphical based. You might use Profile Manager on Server.app if you have lots of clients to configure and another MDM solution doesn't work for you.

No matter which tool you choose to craft the profile, it's just a file you place on a web server or email to the clients and then tap/click to install the certificate.

  • However the cert is untrusted. So there seems to be an another TrustStore which has been initially saved in Security.Buddle. Like some apps only trust the cert in there? I have no idea about why the Charles can't capture the package from Ingress. – Sequencer Feb 10 '16 at 18:47
  • @Sequencer You're right - you'll need to push the root certificate as well if the one you push initially is not trusted and is signed by another cert. I assumed you were pushing the root when you said CA - but it seems you were initially configuring just a certificate and not the initial authority. You can use the Certificate Assistant from Keychain Assistant to request SSL certs from a server and then pick them apart and request the base one in many cases. – bmike Feb 10 '16 at 19:15
  • Thank you for your reply. however it still returns error. In Charles I have this Charles Proxy Custom Root Certificate.cer(is the root) and charles-ssl-proxying.p12and charles-ssl-proxying-certificate.crt no matter how I add this to config file pip and ingress.app's package capture still not working. – Sequencer Feb 10 '16 at 20:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .