1

I've previously posted this question and since then further investigated the issue.

The problem seems to be the latest iOS (13.4.1), which fails to send the client certificate upon authentication requests.

To test this, I've set up a webserver, requiring a client certificate for authentication. The client certificate is installed on the iPhone. If I navigate to the website, iOS states that a client certificate is required and asks to use the installed one. Once I press continue the connection fails as no certificate is presented to the server.

Exactly the same setup on iOS 13.2.2 works as expected. Client certificate is installed, website is accessed, iOS asks about sending the certificate, iOS does so and access works fine.

I've written a bug report to Apple but have yet to hear from them.

Update: iPadOS 13.3.1 also works as expected.

Update: iOS Beta 13.4.5 has the same issue.

Does anyone else experience this issue or is this an isolated case for me? I've even hard-reset the iPhone to check if it was a problem with my setup.

Improve this question
0

2 Answers 2

Reset to default
1

Requirements for trusted certificates in iOS 13 and macOS 10.15

Does the client certificate meet Apple's latest certificate requirements?

All TLS server certificates must comply with these new security requirements in iOS 13 and macOS 10.15:

  • TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits. Certificates using RSA key sizes smaller than 2048 bits are no longer trusted for TLS.
  • TLS server certificates and issuing CAs must use a hash algorithm from the SHA-2 family in the signature algorithm. SHA-1 signed certificates are no longer trusted for TLS.
  • TLS server certificates must present the DNS name of the server in the Subject Alternative Name extension of the certificate. DNS names in the CommonName of a certificate are no longer trusted.

While the document mentions server certificates, I suspect client certificates will also be rejected if they using SHA-1 or weak keys.

Debugging with openssl s_server

Try debugging the TLS connection with OpenSSL's test server, see Verify Incoming SSL Using OpenSSL S_Server for a related question.

Improve this answer
5
  • 1
    Thanks for the hint! I've considered this to be an issue, but both devices, which work as expected use iOS > 13 (13.3.1 and 13.2.2) so I believe this should not pose an issue. I'm confident I meet these requirements, but I'll test it anyway to make sure.
    – GarlicCheese
    Apr 22, 2020 at 13:07
  • 1
    I believe I am seeing something similar. On any iOS 13.4.1 browser I am getting a certificate error from my TLS 1.2 + 1.3 web application. However, on MacOS 10.15.4 all works ok with any browser (including Safari)
    – Andrei Dascalu
    Apr 26, 2020 at 17:16
  • @AndreiDascalu that is concerning. What server are you using? Can you confirm the certificate meets all the new requirements? Who signed the certificate?
    – Graham Miln
    Apr 26, 2020 at 18:53
  • @GrahamMiln it's a letsencrypt certificate, names are in SAN, etc. ALso works perfectly on MacOS, just not on iOS, so the requirements are satisfied unless there's something iOS specific that I missed.
    – Andrei Dascalu
    Apr 28, 2020 at 9:03
  • Being LetsEncrypt rules out the certificate being a problem. Have you reported this problem directly to Apple?
    – Graham Miln
    Apr 28, 2020 at 10:09
0

After reaching out to Apple via official bug reports, twitter and their discussions board and no feedback, this finally seems to be fixed in the iOS BETA 13.5 (17F5065a).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .