0

I'm trying to make iOS Safari accept an https website that runs a certificate I signed with my own CA.

My CA cert is here: https://gist.github.com/BenMorel/014d7bd7802b75eec78b0bc0bad7e4e1

When I import this CA in Chrome / Edge / Firefox, on Windows & Linux, all the browsers accept the certificate and allow me to browse my website with no warning.

On iOS, however, I can't make this work. I downloaded the CA from the URL above, then followed all the steps listed here.

The CA is now listed in the Configuration Profiles, and enabled in the Certificate Trust Settings. With that done, I'm still getting the following errors:

  • iOS Safari:

    Safari can't establish a secure connection to server

  • iOS Chrome:

    ERR_SSL_PROTOCOL_ERROR

  • iOS Firefox:

    An SSL error has occurred and a secure connection to the server cannot be made.
    NSURLErrorDomain

Again, this works fine with all desktop browsers. What did I miss?

Improve this question
3
  • Why are you creating your own authority? You can't expect users to your website to go through the process of importing a new certificate authority, nor should they do so for security reasons. – Stephen Ostermiller♦ Nov 27 '20 at 16:28
  • For my dev websites. I need https to test Facebook integration, the getUserMedia() API, and so on. Creating a CA allows me to add it once and for all to all my devices, then I can create as many certificates as I want without going through configuration again. – BenMorel Nov 27 '20 at 17:34
  • For those interested, I'm maintaining some scripts & instructions here: github.com/BenMorel/dev-certificates – BenMorel Nov 27 '20 at 17:34
1

Found the reason on the Apple website: https://support.apple.com/en-us/HT210176

The reason is not the CA, but the certificate itself:

Additionally, all TLS server certificates issued after July 1, 2019 (as indicated in the NotBefore field of the certificate) must follow these guidelines:

  • TLS server certificates must contain an ExtendedKeyUsage (EKU) extension containing the id-kp-serverAuth OID.
  • TLS server certificates must have a validity period of 825 days or fewer (as expressed in the NotBefore and NotAfter fields of the certificate).

Connections to TLS servers violating these new requirements will fail and may cause network failures, apps to fail, and websites to not load in Safari in iOS 13 and macOS 10.15.

And it looks like the 825 days limit will soon be lowered to 398 days.

So I changed my ext file to contain:

extendedKeyUsage = serverAuth, clientAuth

And generated a certificate valid for 365 days only:

openssl (...) -days 365

And it now works! 👍

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.