1

I've installed a SSL client certificate into the version of Safari that comes with iOS 11.4.1. It apparently allows me to access a protected site as expected.

Are there any specific privacy issues that may result from this installation? In particular, how does Safari decide when to present certificates such as mine to web sites? I'd ideally like to have a configuration where Safari ties the certificate to a particular site (or URL) and presents the certificate (i.e. attempts authentication with it) only when I visit that site. Is that possible?

Improve this question

2 Answers 2

Reset to default
0

Safari (or any other web client) doesn't present its client certificate unless requested by the website. So your client certificate is safe. The server is always the one asking for the certificate, sending along its own certificate. Therefore, your browser will see that the certificate do not match the one you have and will result in failure, unless the server sends the right certificate to match yours, in this case, you can be sure you're on the good website.

Improve this answer
3
  • So does that mean that the client checks the server's certificate first, and only if this check passes, it will present its own certificate(s)?
    – Drux
    Aug 3, 2018 at 18:16
  • Yea, the client checks the server certificate using its private key, and then present its public key. Note that your public key is as it implies public : there's no issues if it's leaked, that's the beauty of public-key crypto. If someone gets a hold of your public key, and this will happen as it's intended, they can't do anything with it unless they have the private key, which you never present, you only use it to decrypt locally.
    – Jean Rostan
    Aug 3, 2018 at 20:19
  • 1
    Thx. My concern is about privacy (an SSL client certificate potentially being presented on an overly broad basis like a "universal cookie"), not about public key cryptography as such. If you can point to documentation which explains under which circumstances Safari (the iOS version) presents which certificates ("profiles") to which sites, I'll accept your answer.
    – Drux
    Aug 4, 2018 at 6:27
2

This accepted answer is wrong. It is referring to server certificates, not client authentication certificates.

The answer is, Safari prompts you when the web server is set to require certificate authentication.

In every browser I've seen, the browser will not prompt you to select a certificate if it does not have any certificates signed by a CA the server trusts.

Improve this answer
1
  • It does prompt on Mac, but it doesn’t prompt on IOS, but picks the first one installed. And this is annoying if someone (like me) has multiple certificates.
    – Valentin
    Oct 28, 2022 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .