Charles the debugging proxy is able to create self-sign certificate for iOS, and I want to do the same with my testing app. So I use SSL to set up the connection between an iOS app and a server. The server's certificate is self-signed and will not be accepted by the iOS. I downloaded the certificate file to the iOS device I was using and manually installed it into the system, and it reads red text Not Verified. My app still fails to connect to the server (while the Android app could establish a connection just fine). Is there a way to create a self-signed trusted certificate for an iOS device like Charles the debugging proxy is able to do?
Related
It appears that Apple has removed the ability to trust SSL certificates that are self-signed in iOS 10.
I created my own self-signed certificate and have a local web server that signed with my certificate. I must install my certificate in iOS for testing locally as I have developed an iOS application that needs to trust my certificate.
How can I install my self-signed certificate?
Good news, they haven't. If you just need this for development purposes, which it sounds like you do (and you shouldn't be using self-signed certificates in production anyway), you can install the self-signed certificate on your iOS devices manually. Following the equivalent FAQ for my iOS Web Bluetooth browser app:
Create your self-signed certificate and key files using openssl or however. Be sure it has the correct /CN “Common Name” for your local server, e.g. mycomputer.local.
Configure your webserver to use it (obviously) and check that it is working using a different client, such as a browser on a Mac.
Email your certificate to an email address you can access on your iOS device.
Tap on the attachment in Mail on your iOS device, this should now prompt you to install it. Do so.
You should now verify that it is installed by going to the Settings app then General -> Profile -> <Common Name>. The Profile menu probably won’t be there at all until you’ve installed the first certificate. The certificate should be marked Verified (it was verified by you when you installed it).
You might, like I did, have thought this would be enough. It isn’t. You now, really counter-intuitively, need to go to the setting General -> About -> Certificate Trust Settings and enable full trust for your certificate there as well. It’s such a weird place for that setting to be.
The installation of own root certificates changed at some point (maybe somebody can confirm, if it was at iOS 11).
What you need to do is with your Mac, get Apple Configurator 2 and create a profile containing your certificate. The resulting mobile profile file can be installed from Safari or email.
I want to debug some HTTPS traffic from an IPhone app using Fiddler.
After installing the Fiddler-generated certificate on the IPhone, I am able to see most of the HTTPS-Traffic but unfortunately the HTTPS-Requests I want to debug use a client certificate which I have to copy to my PC in order to see the traffic.
Is there a general way to download that specific certificate?
I am using Charles Proxy to see all of the traffic that is coming out of my iphone. I have the ssl certificate/profile installed on my iphone and I can see a lot of the traffic that is ssl encrypted. However, some applications seem to not finish the ssl handshake.
The error is: "SSLHandshake: Remote host closed connection during handshake" and then Charles Proxy suggests to configure the application to trust the Charles Root Certificate. I thought I did when I installed the profile onto my iphone?
Any explanation of this/way to fix it?
Yes, SSL pinning is a possibility. Although as of iOS 10.3, you must take an additional step to trust the Charles Root Certificate that is not currently documented on their website edit: this info is now under iOS Devices here: https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/
Settings > General > About > Certificate Trust Testings
Source: https://www.neglectedpotential.com/2017/04/trusting-custom-root-certificates-on-ios-10-3/
There are applications which don't simply expect the certificate signed one of the trusted CA's on the system, but which expect a single specific certificate or a certificate containing a specific public key. This is called certificate/public key pinning. For this application it will not work if you configure the CA of Charles Proxy as trusted on the system because they will not use this CA.
Any explanation of this/way to fix it?
If the application is built to only trust a single certificate/public key and never trust something just because it is signed by a locally trusted CA, then you would need the original certificate and its private key to do the SSL interception. Since you don't have these there is no way to do the SSL interception.
I have an SSL wildcard that my web service uses. My iOS app works with this back end. The certificate expired and my app stopped working.
The SSL is now renewed (godaddy) but my app only works in the simulator. When loaded on an actual device, it's still not liking the SSL.
Here's the error I'm receiving:
NSURLErrorDomain error -1012
How can I fix this and have the device work again with the new SSL?
Thanks for the advice above, but, the fix was needed on the server, as other versions are live now...
so first I checked my certificate was not configured properly on AWS ELB,
the thing is i had to include the certificate chain,
for checking the correct configuration of my SSL I used an app called "SSL detective", and geotrust SSL toolbox,
Now basic cert and cert chain working, no need to change app.
I am working on mobile HTML5 site using HTML5/JQueryMobile and server is in php. I changed sever settings from HTTP to HTTPS but now from my mobile it shows these type of error
[Error] Failed to load resource: The certificate for this server is invalid. You might be connecting to a server that is pretending to be “www.example.com” which could put your confidential information at risk.
when using in IPhone 5 with IOs 7.1.2.
How to handle that issue. What things i have to do?
For us this happened with the update to iOS 13. The requirements for trusted certificates changed, so we needed to adjust the certificate.
See the official page of Apple
You are using a self-signed certificate. Thus your iPhone doesn't trust your certificate.
Either add the certificate to your iPhone as a trusted certificate. (recommended)
Or create a official certificate from a trusted authority. (recommended for production usage)
Or make requests and allowing insecure (self-signed) certificates. (not really recommended, but might be the fastest solution)