16

The DigiNotar root CA has been compromised and has been blacklisted by Mozilla and Chrome. I've already un-trusted their root CA in Keychain on my OS X devices, but how can I do something similar on my iPhone and iPad?

Edit: I'd like to do this without having to jailbreak any device.

Edit: The i0S 5 update from Apple removes the DigiNotar root CA from your iDevice and also gets rid of trust for MD5-signed certs. See this Ars Technica article for details.

Improve this question
8
  • 3
    Excellent question. One thing that did not work was using the iPhone Configuration Utility (under Credentials) to supply the iPhone with the DigiNotar certificate set to "Never trust". I was hoping this would override IOS' built-in certificate, but it still lets you happily browse to your doom. Worst case we will have to wait for an IOS update (lest you want to jailbreak).
    – Ingmar Hupp
    Aug 31, 2011 at 14:00
  • What sites are still using a certitifact that is signed by the one compromised cert? How do you know you are actually browsing to doom and not that the sites you visit have changed the certs they use back to one with a trusted root?
    – bmike ♦
    Aug 31, 2011 at 14:17
  • @bmike the crux of the problem is that, on iOS Safari, it seems to be impossible to check and see which certs a site are using and avoid ones with compromised certs. The blacklist from Mozilla is far bigger than the compromised list admitted to by DigiNotar so that means there are definitely certs DigiNotar has left in place that it thinks are safe, but that Mozilla and others disagree with.
    – Ian C.
    Aug 31, 2011 at 14:29
  • 1
    I've used auth.pass.nl for testing, which still has a SSL certificate signed by the compromised CA. There's likely plenty more to find (especially in the .nl namespace). Check in a Desktop browser first if the certificate is affected.
    – Ingmar Hupp
    Aug 31, 2011 at 15:51
  • 1
    Apple has a list of all trusted root certificates on IOS.
    – Ingmar Hupp
    Aug 31, 2011 at 15:56

1 Answer 1

Reset to default
5

You don't. (not without jail breaking iOS) More sadly, we've gone from the situation on iOS 4 -> 5 ->6 -> iOS 7 and still cannot choose what certificates are trusted by the OS.

This is either a bug in the iPhone configuration utility or an unimplimented feature. If you care, do reach out to apple to ask for this.

http://www.apple.com/feedback or http://bugreporter.apple.com

Unless you are comfortable writing a technically correct bug, the feedback link is a better avenue. Calling AppleCare or asking for this at the genius bar might also be worthwhile.

Improve this answer
1
  • Is there a way to remove a root certificate if you do have jailbroken iOS?
    – rakslice
    Sep 26, 2014 at 0:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .