0

Good morning, we've got iPads running with a native App and would next use a safari Homescreen Shortcut for a web based catalog. However, connecting to the F5 LTM, which rotates and terminates the (internal)SSL connections towards AWS ingress controllers results in a redirect loop, where the console tells:

default 13:59:24.084312 +0100   com.apple.WebKit.Networking [C324 Hostname#3249e3e3:443 tcp, pid: 342, url: https://katalog.company.domain/, tls] start
default 13:59:24.084919 +0100   com.apple.WebKit.Networking nw_connection_report_state_with_handler_locked [C324] reporting state preparing
[...] 
default 13:59:24.152504 +0100   com.apple.WebKit.Networking TIC TLS Event [324:0x104a86050]: 11, Pending(0)
default 13:59:24.152647 +0100   com.apple.WebKit.Networking TIC TLS Event [324:0x104a86050]: 14, Pending(0)
default 13:59:24.171978 +0100   trustd  cert[0]: MissingIntermediate =(leaf)[force]> 0
default 13:59:24.172312 +0100   com.apple.WebKit.Networking Trust evaluate failure: [leaf MissingIntermediate]
default 13:59:24.172390 +0100   com.apple.WebKit.Networking TIC TLS Trust Result [324:0x104a86050]: 4
error   13:59:24.172439 +0100   com.apple.WebKit.Networking TIC SSL Trust Error [324:0x104a86050]: 3:0
default 13:59:24.172474 +0100   com.apple.WebKit.Networking TIC TCP Conn Cancel [324:0x104a86050]
default 13:59:24.172671 +0100   com.apple.WebKit.Networking [C324 Hostname#3249e3e3:443 tcp, pid: 342, url: https://katalog.company.domain/, tls] cancel
default 13:59:24.172711 +0100   com.apple.WebKit.Networking [C324 Hostname#3249e3e3:443 tcp, pid: 342, url: https://katalog.company.domain/, tls] cancelled

So there it is, quite visible

missingIntermediate

We've added the rootCA and intermediate on the devices via mdm. I can see the rootCA is trusted. The mdm profile lists the certificates properly.

Chrome says: NET:ERR INVALID_CERT_AUTHORITY

The certificate names are the sort of: company Name Root.cer, which results in %20 URL encoding behaviour at certain perspectives.

Might this cause the above behaviour?

Our network is rather locked up, and we've explicitly allowed outside communication for the devices - which so far works well.

What am I missing?

1

Most probably you have installed the intermediate certificate in the wrong place. The root certificate should be added to the trust store on the iPad - this you've got working already.

The intermediate should NOT be placed in the trust store - instead it needs to be installed in the Keychain instead.

Spaces in the file names haven't got anything to do with the problem, as the file names "disappear" when the certificates are imported.

Note: In terms of "best practice" the way you are preceeding are more or less a work-around for the fact that you've got a misconfigured server/F5. You need to install the intermediate certificate on the server/F5 (i.e. whatever terminates your SSL), so that the TLS server actually replies with the full chain including the intermediate certificate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .