Powershell New-SelfSignedCertificate CA not working on iOS 14.2

user_1694612 0
Viewed 489

I'm trying to generate a CA and SSL certificate for a IIS application using Powershell. It works as expected on Windows when I manually add the CA to the local machine certificate root store.

The problem is connecting from a smartphone, the iPhone refuse to recognize the CA when I try to install it.

This is the CA script:

$ca_certificate = New-SelfSignedCertificate -CertStoreLocation cert:\CurrentUser\My -NotAfter (Get-Date).AddDays(820) -DnsName 'VMS Certificate Authority' -KeyusageProperty All `
 -KeyUsage CertSign, CRLSign, DigitalSignature -FriendlyName 'My CA' -KeyAlgorithm RSA -KeyLength 2048

Export-Certificate -Cert "Cert:\CurrentUser\My\$($ca_certificate.Thumbprint)" -FilePath "$PSScriptRoot\root-authority-public.cer"

I can install the profile on my iPhone but during the installation i get the warning message "The authenticity of "My CA" cannot be verified" and nothing else. After the installation the status is still "Not verified". There's nothing under General->About->Certificate Trust Settings (only trust store/asset version).

I managed to create a openssl CA and that is successfully added to the phone but not recognized by the application using the SSL certificate.

Does anyone have any experience with this?

certificate powershell ssl iphone ios
2 Answers

I managed to get it working. Apparently iOS won't recognize the certificate as a CA unless it has the basic constraint Subject Type=CA.

-TextExtension @("2.5.29.19={text}cA=true&pathLength=2")

So a full command for a CA valid 5 years could be

$ca_certificate = New-SelfSignedCertificate -CertStoreLocation cert:\CurrentUser\My -DnsName 'My Awesome CA' -KeyusageProperty All `
 -KeyUsage CertSign, CRLSign, DigitalSignature -FriendlyName 'My Awesome CA' -TextExtension @("2.5.29.19={text}cA=true&pathLength=2") -NotAfter (Get-Date).AddYears(5)
user_16946120

IMPORTANT:

Once you've created your certificate you must export it as a CERTIFICATE and not as a PFX certificate. The PFX certificate contains the secret key and needs to be password protected. I'm not sure if this is an iOS 15 change but it could be.

I had tried a dozen different combinations of the New-SelfSignedCertificate command but it turned out I was exporting my certificate with:

Export-PfxCertificate -cert cert:\localMachine\my\6C730102B3E... -FilePath 1.pfx

As soon as I switched to this command it worked:

Export-Certificate -cert cert:\localMachine\my\6C730102B3E... -FilePath 2.pfx

Yes I am deliberately using .pfx as the extension. You could use .cer, but I'm installing it by visiting it in Safari as a URL and .cer didn't seem to work. The point is that the file doesn't contain the full certificate.

When you install it, if you don't get the following message that's an early warning sign it isn't going to work:

Installing the certificate "XXXXX" will add it to the list of trusted certificates on your iPhone. This certificate will not be trusted for websites until you enable it in Certificate Trust Settings.

Then of course you need to go to General->About->Certificate Trust Settings to enable it - and it should now show up there.

Simon_169400
Related