Importing an SSL cert under the iPhone SDK

Question

My app connects to the Schwab OFX server using NSURLConnection. Unfortunately the server uses a very recent intermediate certificate that is trusted on the Mac desktop but not yet the iPhone. (Try the URL—you'll get a cert error on iPhone.)

There's no easy way to tell NSURLConnection to ignore an invalid cert that I know of. Thus I'm trying to import the cert into the Keychain manually and set its trust level but I've hit a block.

I call SecCertificateCreateWithData successfully to import the certificate from a .cer file. On the desktop I would then call SecTrustSettingsSetTrustSettings, but it doesn't exist in the iPhone SDK.

Any workaround?

Answer 1

Apple technical support responded to me promptly with a perfect answer.

First, I am incorrect in saying that Schwab uses "a very recent intermediate certificate that is trusted on the Mac desktop but not yet the iPhone". Intermediate certificates are never in the built-in root certificate store. The issue is that most SSL servers bundle all intermediate certificates needed for verification, but Schwab uses an alternate SSL process that expects you to fetch the intermediate certificate from a URL. The Mac desktop supports intermediate-certificate fetching, but not the current iPhone OS.

Here's the gist of the actual code:

OSStatus            err;
NSString *          path;
NSData *            data;
SecCertificateRef   cert;

path = [[NSBundle mainBundle] pathForResource:@"OFX-G3" ofType:@"cer"];
assert(path != nil);

data = [NSData dataWithContentsOfFile:path];
assert(data != nil);

cert = SecCertificateCreateWithData(NULL, (CFDataRef) data);
assert(cert != NULL);

err = SecItemAdd(
    (CFDictionaryRef) [NSDictionary dictionaryWithObjectsAndKeys:
        (id) kSecClassCertificate,  kSecClass, 
        cert,                       kSecValueRef, 
        nil
    ], 
    NULL
);
assert(err == noErr);

CFRelease(cert);

This assumes that OFX-G3.cer is the intermediate SSL certificate and is located in the Resources folder.

Answer 2

You can bypass ssl settings using CoreFoundation's CFStream object. You'll need to do something like create a stream that connects to the appropriate port on the OFX server, then use CF(Read|Write)StreamSetProperty to provide a CFDictionary (which you can cast an NSDictionary to) with keys like kCFStreamSSLLevel, kCFStreamSSLAllowsAnyRoot, kCFStreamSSLValidatesCertificateChain, etc.

Answer 3

You can install to the cert directly into the simulator's TrustStore.sqlite3 file. Charles Proxy uses this to install their root cert into the simulator. http://www.charlesproxy.com/documentation/faqs/ssl-connections-from-within-iphone-applications/

Answer 4

Are you trying to do this programmatically or is it okay to do it via normal UI?

The iPhone Configuration Utility from Apple allows you to add certificates to the phone. You can also just email the certificate to a user that can read email on the phone, then open the certificate on the phone and it will ask you if you want to install the cert.

I'm sorry I can't give you more details instructions right now, but I'm away from my iphone. I'll check back later after I can get to the iphone to see if you've met with success.