7

With iOS 10.3 Apple changed the mechanism for trusting a self-signed certificate. Before you simply just send the PEM file to your phone and it would install as a profile and the certificate would be trusted. Now that's no longer the case as even after installing the certificate, the cert is not trusted.

Even when I use Apple Configurator to make a profile that trusts my cert, it still doesn't behave as trusted on the system.

How do I trust a self-signed certificate in iOS 10.3?

Improve this question

2 Answers 2

Reset to default
6

I've identified that the specific parameter that Apple looks for when allowing you to manually trust a certificate is the CA Basic Constraint (E.G. critical,CA:true). If the certificate has this extension, the system will allow you to manually trust the certificate.

However the process has one extra step (as opposed to iOS 9.3):

  1. Export the certificate as PEM format
  2. Send the certificate to the device (Safari, Email, AirDrop, etc...) and open it
  3. A message will appear telling you the profile has been downloaded. modal message reading "review the profile in the settings app if you want to install it"
  4. Open the settings app and tap the "Profile Downloaded" item below your Apple ID row. ios settings app
  5. Install the Certificate. You will have to provide your devices passcode. example certificate install prompt
  6. Navigate to Settings -> General -> About -> Certificate Trust Settings
  7. Enable full trust for your certificate certificate trust settings
Improve this answer
4
  • Can't get 5. and 6. working. Do they have changed it?
    – testing
    Feb 26, 2021 at 15:24
  • It still works for me. You need to make sure that the certificate you're importing is a CA certificate (it must have the CA constraint), otherwise it won't show up in Certificate Trust.
    – ecnepsnai
    Feb 26, 2021 at 20:34
  • Now I added only the CA certificate and not the combined one (CA + intermediate). Afterwards, I got the option you thankfully included in the answer. But the website still can't be opened in Safari on iOS (but on Mac). Are there any more constraints? I do have the CA constraint on the CA and intermediate certificate and extendedKeyUsage = serverAuth for the server certificate. Do all certificates (inlcuding root CA) must have a validity <= 365 days?
    – testing
    Mar 1, 2021 at 16:07
  • To answer my own question: It seems that only the server certificate needs to have a validity < 398 days. On the device you need to install the root CA and trust it like described in the answer. On the server side I used a combined certificate (server + intermediate + root CA). Now it is marked as valid.
    – testing
    Mar 2, 2021 at 12:16
0

I solved it on mine on iOS 10.3 I had to:

  • Delete all profiles. (working phones didn't show a profile anyway)
  • Delete the offending POP account
  • Create a different POP account pointing to a different server
  • THEN you can open the server list and delete the offending outbound server. That deletes the "bad" certificate apparently. No other way to get to it because when you delete the single POP acocunt you lose visibility to the bad cert.
  • Once the bad server is removed, reboot to be sure
  • Rebuild the original POP account, it prompted me it was not trusted, gave me the opportunity to pick "trust"
  • Delete extra POP account to other server
  • fixed me. No "profile" shown in settings.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .