Internal Certificate Authority and iOS
reddit / selfhosted

----------------------------------------------------------------------
Nemergal · 2023-12-28 09:53

Hello!

Sorry, english is not my native language. I wanted to learn OpenSSL,
to not just copy-paste command, and run my own Certificate Authority
in my homelab. Working fine until now for Server Authencation and
Client Authentication.

But now I want to access to my internal websites from my iPhone,
and... I simply don't understand.

My setup is: *Root Certificate Authority (20 years) -> Intermediate
Certificate Authority (10 years) -> Server Certificate (1 year).*

So, my server certificate is signed by my Intermediate Certificate
Authority. In Linux, Windows and other devices, the ca-chain.pem was
added to browsers and everything working fine.

But I'm unable to trust websites on iOS. I followed this path:

1. Pushing Root and Intermediate certificates into My Files
2. Clic on the two .pem files, go to Settings > General > VPN and
device management
3. The two certifiates, Root and Intermediate CA showing up in «
Downloaded profiles », installing it (with PIN code asked)
4. CA certificates now showing in « Configuration profile » and their
status are « Verified » for both
5. Goging into Settings > General > Informations > Certificate Trust
Settings and only my Root Authority is displayed here, which I seems
normal because the description refers to Root Certificates. Well, the
Certificate Authority is enabled here
6. Now going to my local website and... « This connection is not
private »

What I have tried without success:

* Since iOS 13, certificates options requirement has
[changed](https://support.apple.com/en-us/103769). My certificate is
valid for one year, use SHA2, Extended Key Usage (EKU) set to
serverAuthentication, 4096 bits, and subjectAltName are matching my
domain
* Adding clientAuthentication to EKU

Symptoms:

* Chrome show : ERR\_CERT\_AUTHORITY\_INVALID
* Safari, in Show Certiicate: Untrusted by the system because the root
certificate authority is unknow or not present

Was hoping to get an idea when writing this, as I often do, but...

Maybe someone?

Thank you!

----------------------------------------------------------------------
ElevenNotes · 2023-12-28 11:02

Does your webserver send the full chain (all certs)?

----------------------------------------------------------------------
Nemergal · 2023-12-29 20:00

Hello,

My server send only web cert + intermediate CA. I read multiples times
that Root CA must not be sent, why?

----------------------------------------------------------------------
Nemergal · 2023-12-30 00:49

Got the solution. My domain under TLS is registered with a CNAME in my
DNS. If I change for A type, it's okay. Ref: [https://www.reddit.com/r
/selfhosted/comments/xkg08p/comment/iq2203p/](https://www.reddit.com/r
/selfhosted/comments/xkg08p/comment/iq2203p/?utm_source=reddit&utm_med
ium=web2x&context=3)