7

When I try to access our dev sites, I get this error on my iPhone X running the latest general release of iOS 15. Now 15.1.

Safari cannot open the page because it could not establish a secure connection to the server.

I believe the problem is related to a root certificate expiring.
https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

On Mac (macOS Big Sur 11.6.1) I was getting the same problem. When I inspected the certificate, it said the R3 and DST Root CA X3 certificates were expired. I was able to fix the issue by installing the R3 intermediate certificate. My Mac already had the ISRG Root X1 certificate installed.

On iOS I've tried installing the root certificates ISRG Root X1 and X2, and the R3 intermediate certificate, and every combination thereof but I still can't load my dev sites.

On Chrome for iOS I get ERR_SSL_PROTOCOL_ERROR.

Using the free iOS app TLS Inspector, I get this for my dev site: enter image description here

4
  • I get this when visiting Wikipedia in iOS 9.3.5 but not in recent iOS.
    – lhf
    Oct 1, 2021 at 16:42
  • This helped visiting other sites but not Wikipedia: appletoolbox.com/…
    – lhf
    Oct 1, 2021 at 16:44
  • 1
    I'm not confident this is a real fix yet but could you get someone to force a renewal of the Let's Encrypt certificates on the dev sites? I've seen similar problems on one of my servers and it appears Apple devices might be caching the certificate.
    – PeterJ
    Oct 2, 2021 at 13:16
  • @PeterJ we actually installed brand new certs on 4 Oct and that didn't solve the problem unfortunately :/
    – tvanc
    Oct 8, 2021 at 20:54

3 Answers 3

0

Your developers will need to update their configuration so that all iOS devices trust them again. You might be able to work around this on iOS similar to how macOS could manually install the missing certificates and manually trust them, but I don’t have those specific handy for iOS. Here are mac details…

Following description applies to all Mac OSX versions which are not updated by Apple any more at least security related. (which is a shame but this is an other story)

  1. Open following page in your browser: https://letsencrypt.org/certificates/
  2. When it warns, make an exception for this site and proceed.
  3. Download the ISG X1 and ISG X2 certificates as pem files and save these.
  4. Double click on the pem files in Finder and the key manager should ask you what to do with the files. Select to open these as System certificates. (Drop down box). Do this for both files.
  5. The key manager should be opened already. (Key chain icon) Go to the system section here and you will see the ISG X1 and ISG X2 certificates marked with red crosses.
  6. Double click either and you should see it is not trusted. Expand the trust section and select "Always trust" to everything. Do this for both ISG certificates. Close the dialog.
  7. Restart your system.

Sorry I do not have time for some screenshots, please ask if you stuck.

4
  • Your post here might work far better on a MacOS specific question or as an edit to my answer there explaining how to manually load certs on macOS versions no longer getting these updates from Apple.
    – bmike
    Oct 8, 2021 at 9:15
  • Sorry but isn't this a MacOS specific forum here. Don't think Safari is being considered to be used elsewhere, isn't it?
    – Thomas
    Oct 8, 2021 at 11:19
  • 2
    No, this isn’t a forum. This Q&A site covers all products and services Apple offers. This specific question is looking for answers relating to mobile Safari running on iOS. You can learn more about us in the help center (also, I gave you +1 as this answer is superb, just not addressing this specific question IMO)
    – bmike
    Oct 8, 2021 at 11:29
  • Dumb me, you are right, was too fast for this. Thanks for the hint anyway.
    – Thomas
    Oct 8, 2021 at 11:56
0

You should be able to solve this by setting up proper certificate chaining on your server. That's way better than doing it on each client.

The security systems in iOS will (and should) try to keep users from breaking the security of the platform by installing certificates not known to be trustworthy. Your server should be providing this cert. Instead, it's providing an expired R3 cert - as we see in your screenshot.

The https://letsencrypt.org/certificates/ page Thomas links to gets you headed in the right direction. Use it from iOS to figure out were the break(s) in the chain is(are).

Provide more info on your server setup if you need and can't find more details.

Unless your server is a Mac, the solution to the problem isn't Apple-related.

You want to see something like this. Here, the SERVER for a random domain that just got issued a Let's Encrypt cert and that server is correctly providing the R3 cert.

the SERVER for https://aliarad.com/ is providing the R3 cert so that the chain makes the domain's cert is valid.

2
  • Give us a screenshot from the Mac showing the equivalent of the above - Presumably, this is the root cert - crt.sh/?caid=7394 Nov 5, 2021 at 5:48
  • Your answer should work in theory. But iOS has cached the certificate chain and won't uncache it short of a factory reset. Other iOS devices that have never visited the site get the proper certificate chain which links ultimately to ISRG Root X1. I don't have my mac handy but it showed a chain just like your screenshot, once I installed an updated intermediate cert. This user reports exactly the same problem. discussions.apple.com/thread/253215778
    – tvanc
    Nov 5, 2021 at 18:33
0

The solution to this problem ended up being to use new iOS devices. iOS was failing to load the updated certificate and there was no way I could find to force it to load the new certificate. I'm sure that's not very satisfying.

Any iOS device I tried that had never visited the domain before loaded the new, valid certificate.

Any iOS device which had already loaded the old expired certificate would not load the new certificate no matter what I did. I did not try completely resetting any device because that wasn't worthwhile at the time.

When I replaced my iPhone X with a newer model the problem went away.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .