I am installing a self-created certificate authority SSL cert onto a modern (iOS-9.3.2, iPod6) iOS device. It is self-signed and obtained over an untrusted transport. In normal, e.g. desktop, environments, I’d be able to print out the certificate’s fingerprint or view the fingerprint to verify that the certificate copied to the device is the same as the one I created. For example, on any unix system:

ohnobinki@ohnopublishing ~ $ openssl x509 -noout -fingerprint -in /etc/ssl/certs/GlobalSign_Root_CA.pem
SHA1 Fingerprint=B1:BC:96:8B:D4:F4:9D:62:2A:A8:9A:81:F2:15:01:52:A4:1D:82:9C

When viewing the certificate on iOS, I end up at the “Install Profile” screen. It lets me view things like “Subject Name”, “Issuer Name”, Subject Key Identifier”, “Public Key Identifier”, “Signature”, et al. I guess I can verify that the key is the same by comparing all the octets of the Signature—but there are a ton of octets compared to the fingerprint which is already a burden to validate. Also, when I tap and hold on the “Signature”, I get no option to Copy the octets or anything useful.

What is the best strategy for validating that a certificate downloaded to an iOS device matches the one you created and intend to install rather than one crafted by an untrusted/malicious party?

You must log in to answer this question.

Browse other questions tagged .