I host several web services on my internal network and have created TLS certificates for each of them, all signed by my home-baked OpenSSL certificate authority. I've imported the CA certificates into Keychain on my MacBook and into my trusted certificate store on my Windows PC, and since then have had no "invalid certificate" errors pop up when accessing my internal sites via Chrome, Firefox, or Safari.
However, I was not able to reproduce this on my iPhone. I installed the CA certificate files and trusted them fully, but I get an invalid certificate warning when navigating to sites with certs signed by this CA.
Why does this setup behave differently with iOS? Do these CA files need to be bundled when importing into iOS?
One thing I noticed in troubleshooting: my CA consists of a root CA and a signing CA issued by the root, and in the Certificate Trust Settings page in Settings (Settings > General > About > Certificate Trust Settings), I'm only given the option to fully trust the root CA (not the signing CA), despite the fact that both certs are verified.