iOS certificate import - .p12 vs. NSData - ios

Question

I have a problem with usage of client certificate in iOS.
When I store .p12 file in my application and import it like this:
-(void)importCertificateToKeychain:(NSURL *)url
withPassword:(NSString *)password
name:(NSString *)name {
importedItems = NULL;
NSData* data = [url isFileURL] ? [NSData dataWithContentsOfFile:url.path] : [NSData dataWithContentsOfURL:url];
err = SecPKCS12Import(
(__bridge CFDataRef) data,
(__bridge CFDictionaryRef) [NSDictionary dictionaryWithObjectsAndKeys:
password, kSecImportExportPassphrase,
nil
],
&importedItems
);
if (err == noErr) {
for (NSDictionary * itemDict in (__bridge id) importedItems) {
SecIdentityRef identity;
identity = (__bridge SecIdentityRef) [itemDict objectForKey:(__bridge NSString *) kSecImportItemIdentity];
NSMutableDictionary *addItemDictionary = [NSMutableDictionary dictionaryWithObjectsAndKeys:
(__bridge id)identity, kSecValueRef,
nil
];
[addItemDictionary setValue:name forKey:(__bridge NSString *)kSecAttrLabel];
err = SecItemAdd((__bridge CFDictionaryRef)addItemDictionary, NULL);
}
This works fine and I can load it just fine with:
-(NSURLCredential *)loadCertificateFromKeychain:(NSString *)name {
OSStatus err;
CFArrayRef latestIdentities;
NSMutableDictionary *filterDictionary = [NSMutableDictionary dictionaryWithObjectsAndKeys:
(__bridge id)kSecClassIdentity, kSecClass,
kSecMatchLimitAll, kSecMatchLimit,
kCFBooleanTrue, kSecReturnRef,
nil];
[filterDictionary setValue:name forKey:(__bridge NSString *)kSecAttrLabel];
err = SecItemCopyMatching((__bridge CFDictionaryRef)(filterDictionary),
(CFTypeRef *) &latestIdentities
);
SecIdentityRef identityRef = (SecIdentityRef)CFArrayGetValueAtIndex(latestIdentities, 0);
id certificates = nil;
NSURLCredential* credential = [NSURLCredential credentialWithIdentity:identityRef certificates:certificates persistence:NSURLCredentialPersistenceNone];
return credential;
}
And I then use credentials in
[[challenge sender] useCredential:newCredential forAuthenticationChallenge:challenge];
But when I get the same certificate not stored in .p12 file but in NSData format from the server this does not work anymore. I tried to put received NSData to the SecPKCS12Import but it returns -26275 so I guess it's not just a NSData of p12 but only the "extracted" certificate.(I do not controll the server side)
That's why I also tried to use
SecCertificateCreateWithData(NULL, (__bridge CFDataRef)(certificateDataFromServer));
And save the result with:
CFTypeRef cert = nil;
CFStringRef certLabel = CFStringCreateWithCString(
NULL, certLabelString,
kCFStringEncodingUTF8);
OSStatus err =
SecItemAdd((__bridge CFDictionaryRef) [NSDictionary dictionaryWithObjectsAndKeys:
(__bridge id)
kSecClassCertificate, kSecClass,
kCFBooleanTrue, kSecReturnRef,
deviceCertificate, kSecValueRef,
certLabel,kSecAttrLabel,
nil],
&cert);
then in authenticateForChallenge I use the identity and certificate
- (BOOL)authenticateForChallenge:(NSURLAuthenticationChallenge *)challenge
{
if ([challenge previousFailureCount] > 0) {
return NO;
}
NSURLCredential *newCredential = nil;
NSURLProtectionSpace *protectionSpace = [challenge protectionSpace];
if ([protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) {
SecIdentityRef identity = [self clientIdentity];
NSArray *certs = [self clientCertificates];
if (identity) {
newCredential = [NSURLCredential credentialWithIdentity:identity
certificates:certs
persistence:NSURLCredentialPersistenceNone];
[[challenge sender] useCredential:newCredential forAuthenticationChallenge:challenge];
return YES;
}
return NO;
}
}
But it does not work. In debug I can see that there is correct identity and an array of one correct certificate but there is no client certificate used on the server and authentication does not work.
Server log:
TLSv1.2 - "POST /my_service/v1 HTTP/1.1" - --- - (certificate should be here instead of ---)
Is someone please able to see what's wrong with my approach? I really thought this should work especially when in useCredential: forAuthenticationChallenge is correct certificate. How can it possibly disappear?
thx
m!
note: In a different application (which share the keychain with the first) I can see that there are two identical identities and one certificate stored in the keychain. (but neither one identity works)

Answer 1

maybe some parts of my code will help you resolving your problem. Feel free to give some feedback.
I just had exactly the same problem. I finally managed to solve the SSL handshake issue by taking a closer look on the identities. I realized that there were two identities extracted from my keychain (This is where I hold my DER encoded Client Certificate for Authentication).
This is my working code now:
Store Certificate to Keychain
-(void) addCertToKeychain:(NSData*)certInDer
{
/*certInDer a Base64 encoded NSData from a String which I received from server ([[NSData alloc] initWithBase64Encoding:resultString];)*/
SecCertificateRef cert;
cert = SecCertificateCreateWithData(kCFAllocatorDefault, (__bridge CFDataRef)(certInDer));
NSMutableDictionary *dictionary = [[NSMutableDictionary alloc] init];
[dictionary setObject:(__bridge id)kSecClassCertificate forKey:(__bridge id)kSecClass];
[dictionary setObject:(__bridge id)(cert) forKey:(__bridge id<NSCopying>)(kSecValueRef)];
OSStatus status = SecItemAdd((__bridge CFDictionaryRef)dictionary, NULL);
assert(status == noErr || status == errSecDuplicateItem);
}
Get the needed Identity back from Keychain (let the keychain handle the difficult part ;)
- (NSURLCredential*)getClientCertFromKeychain {
OSStatus err;
CFArrayRef latestIdentities;
NSURLCredential *credential=nil;
NSMutableDictionary *filterDictionary = [NSMutableDictionary dictionaryWithObjectsAndKeys:
(__bridge id)kSecClassIdentity, kSecClass,
kSecMatchLimitAll, kSecMatchLimit,
kCFBooleanTrue, kSecReturnRef,
nil];
err = SecItemCopyMatching((__bridge CFDictionaryRef)(filterDictionary),
(CFTypeRef *) &latestIdentities
);
/*This is the interesting part: The query might return more than one identity!!! */
//NSLog(#"Array Count %#",latestIdentities);
// Identity to obtain a certificate.
if(err == errSecSuccess) {
/*Here you can choose the identity to use, maybe you have to try according to your certificate structure*/
SecIdentityRef identityRef = (SecIdentityRef)CFArrayGetValueAtIndex(latestIdentities, 1);
SecCertificateRef certificate = nil;
//Create a new CertificateRef from identity
OSStatus status = SecIdentityCopyCertificate(identityRef, &certificate);
if(status == errSecSuccess){
const void *certs[] = { certificate };
CFArrayRef certsArray = CFArrayCreate(NULL, certs, 1, NULL);
NSArray *certificatesForCredential = (__bridge NSArray *)certsArray;
//Fill the credential information
credential = [NSURLCredential credentialWithIdentity:identityRef
certificates:certificatesForCredential
persistence:NSURLCredentialPersistenceNone];
CFRelease(certsArray);
}
CFRelease(certificate);
CFRelease(identityRef);
}
return credential;
}
Use the NSURLCredentials for your authentication challenge
NSURLCredential *certData= [self getClientCertFromKeychain];
if(certData!=nil){
[[challenge sender] useCredential:certData forAuthenticationChallenge:challenge];
} else {
[challenge.sender cancelAuthenticationChallenge:challenge];
}
Best regards