14

With iOS, certificates are installed as part of profiles. Deleting a certificate means removing the profile.

When an iPhone with profiles is backed up, and then the backup is restored to a new device, the profiles are no longer visible under Settings > General > Profiles. So, they can't be deleted via the usual way.

The certificates however get restored to the device. One can see them e.g. under Settings > General > About > Certificate Trust Settings.

Hence my question: How can these certificates be deleted from the device?

1
  • Idea: maybe it's possible to create a new profile overwriting the previous one, then delete that and see if the certificate disappears with it. Maybe it's the payloadIdentifier as noted here developer.apple.com/business/documentation/…
    – Jonny
    Apr 16 '19 at 13:31
24

I found a certificate in my iOS device's Certificate Trust Settings. And it was not be found in Profiles. Finally I remove it by add the cert file again, and then I can found and remove it in Profiles.

At first, I can't found the cert file, because this CA was installed years ago. So I did these things:

  1. Backup iPhone to Mac, View backup file by some software (I used iMazing)
  2. Find TrustStore.sqlite3 in Backup/KeychainDomain/ and export it to HOME DIR.
  3. Use this project https://github.com/ADVTOOLS/ADVTrustStore to export certfile

    ./iosCertTrustManager.py -t ~/TrustStore.sqlite3 -e ~/foo.crt
    
  4. Airdrop or Email this crt file to iOS device, and install it.

  5. Find it in Settings > General > Profiles and Remove it.

  6. It disappear in "Certificate Trust Settings"

Done.

8
  • Great! I used iPhone Backup Explorer for extracting the TrustStore.sqlite3 from an old backup - the free version was enough for extracting this single file (see: iphonebackupextractor.com/guides/itunes-backup-recovery/…). Then was able to remove the Onavo certificate entry using the suggested steps above.
    – emem
    Sep 30 '19 at 14:21
  • This solution worked as a charm! I manually found the TrustStore.sqlite3 in my backup (I don't trust those apps that do that), then followed your instructions.
    – Ian
    Dec 17 '19 at 21:53
  • OMG @mgbaozi - THANK YOU! i was real nervous to do it cause i'm not a programmer nor Terminal user, but i followed your instructions and it worked perfectly! i too use iMazing but i switched to iCloud backups last year, but it found an old backup which had what i needed. my stuck cert w/no profile was an adblocker app that doesn't work anymore called Luna. glad to finally eradicate that from my system. so much appreciation! Feb 4 '20 at 3:11
  • man you saved my life!!!! As of today, this trick still works!!
    – Gordon Gao
    Feb 3 '21 at 9:48
  • Can also confirm that these instructions still work for iOS 14.6, macOS 11.4. The free (demo) version of iMazing is sufficient for doing this. Jul 11 '21 at 19:42

You must log in to answer this question.