iOS Client Certificates and Mobile Device Management

ios ssl client-certificates mobileiron
Brett Donald picture Brett Donald · Sep 19, 2014 · Viewed 15.6k times · Source

Our customers want to use an MDM (mobile device management) solution (MobileIron) to install client certificates onto corporate iOS devices, in order to limit access to certain corporate web services to corporate devices only.

MobileIron installs the client certificate into Settings > General > Profiles, which is the default location for certificates in iOS, and Safari can respond with this certificate when a corporate web service challenges it for one.

But I need the same thing to happen from within a custom app. When our app gets challenged for a certificate, I need to be able to respond with the certificate from Settings > General > Profiles. I have examples of responding with a certificate which is bundled with our app, and with a certificate which our app stores within its own keychain, but I do not have an example of responding with a certificate installed on the device in Settings > General > Profiles.

Can anyone explain to me more about what the NSURLAuthenticationChallengeSender protocol method -performDefaultHandlingForAuthenticationChallenge: does? Does default handling mean that iOS effectively responds to the challenge on behalf of the app? Can this response include a client certificate stored in Settings > General > Profiles?

Update

If the MDM could install a client certificate into the app keychain, that would be perfect.

Answer

Brett Donald picture Brett Donald · Sep 23, 2014

Apple tech support pointed me to the following tech note in response:

https://developer.apple.com/library/ios/qa/qa1745/_index.html

To summarise, what we want to do is not supported.

Related questions

How safe are client SSL certificates in a mobile app?

I'd like to have secure communication between my Android/iOS app and my Internet-accessible backend service, so I'm investigating HTTPS/SSL. If I create self-signed certificates, then put a client certificate in the app and cause the backend service to …

Read More
Swift iOS Client Certificate Authentication

The web service I want to consume requires a client certificate. How can I send my certificate to it? To further elaborate I don't understand how to create the SecIdentityRef. In my NSURLConnection didReceiveAuthenticationChallenge I've got this conditional after ServerTrust: …

Read More
CFNetwork SSLHandshake failed iOS 9

has anyone with the iOS 9 beta 1 had this issue? I use standard NSURLConnection to connect to a webservice and as soon as a call is made to the webservice i get the below error. This is currently working in iOS 8.3 …

Read More