1

I need to be able to access a secure portion of my website from my iPhone. It's a site directory ("infra") where I keep information and routines to manage my home's infrastructure UPS and comms status. I have implemented it using mutual authentication, on each client (browser) that needs to get and put data I have a client certificate (infra_client.cer) which has been issued by my private ca. This works fine on normal desktop browsers but not on safari or chrome on my iPhone, despite the fact that the client certificate and the ca certificate are loaded settings/general/profiles and appear to be verified. When I try to connect the server says:

[Mon Jul 12 06:44:02.452293 2021] [ssl:error] [pid 10010] SSL Library Error: error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate -- No CAs known to server for verification?
[Mon Jul 12 06:44:02.599346 2021] [ssl:error] [pid 10059] [client 86.140.211.152:57830] AH02261: Re-negotiation handshake failed

has anybody any ideas how this can be made to work?

Improve this question

1 Answer 1

Reset to default
1

Apple Requirements

Apple enforce additional requirements on trusted certificates. Ensure your private Certificate Authority (CA) meets these requirements.

openssl s_server

You can confirm, and debug, the iPhone's browsers are providing a certificate with openssl s_server.

s_server can be used to run a debugging SSL/TLS server which lets you examine the negotiation between the server and client:

Apache httpd

For configuring Apache httpd, see Client side certificate authentication as the author encountered the same problem:

Although the allowed CA was properly set I got this error message

SSL Library Error: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate -- No CAs known to server for verification?

In order to solve the problem, I had to merge the certificate CA file and the certificate chain file into one file. For using client certificates with www.digicert.com this meant

cat TrustedRoot.crt >> MergedCA.crt
cat DigiCertCA.crt >> MergedCA.crt

and pointing SSLCACertificateFile to MergedCA.crt

Improve this answer
3
  • Thanks for the observations, aware I can use openssl in the manner described but I'd rather find out what the iOS browser is thinking because all other non phone based cases work fine.
    – Paddy Carroll
    Commented Jul 13, 2021 at 11:39
  • My CA certificates are all fine, they work with everything else
    – Paddy Carroll
    Commented Jul 13, 2021 at 11:40
  • Do your certificates meet Apple's requirements? Are you certain your server is requiring a client certificate? Using s_server, what difference is there when an iOS client connects versus the others?
    – Graham Miln
    Commented Jul 13, 2021 at 13:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .