iOS broke self signed SSL certificates

Question

Level 1

11 points

iOS broke self signed SSL certificates

After updating my iPad 11 Pro to iOS 18, Apple’s email client now refuses to honor the self signed certificate I use for my IMAP server with the error ‘Unable to create a secure connection to the server ("bad certificate format" -9,808).’ Clients on other platforms such as Android, Windows, Linux and Solaris work fine.

I imported my CA root certificate into the iOS trust store and enabled root certificate trust for it, and still cannot get past this error.

The certificates were generated with OpenSSL utilities version 1.1.1w.

Anyone have insight into a more detailed meaning for that error code, or a pointer to a tool that will identify what is offensive with my certificate to iOS. This is a high priority for me.

Thanks.

iPad Pro, iPadOS 18

Posted on Sep 25, 2024 8:37 AM

Reply

Answer 1

Oct 8, 2024 5:02 AM in response to TallPGR

Same issue here. Apple has been discouraging the use of self-signed certificates for a long time now, but as if it wasn't annoying enough to have to reinstall the mails accounts after each major OS update, it seems they have now decided to make it impossible.

Well.. I have to upgrade some of my hardware soon, and guess what; it won't be an Apple anymore. I'm fed up with this.

@TallPGR: you may want to consider LetsEncrypt certificates instead.

Reply

Answer 2

glsexton

Level 1

8 points

Nov 17, 2024 7:00 PM in response to TallPGR

The solution is to create your certificate request with a Subject Alternative Name (SAN record). The hint is the bad format error.

You'll also need to edit openssl.cnf to copy extensions. Edit /etc/ssl/openssl.cnf and uncomment the line:

#copy_extensions = copy

Verify your signed cert has the SAN record and it will work as expected.

Reply

Answer 3

Nov 23, 2024 7:22 AM in response to glsexton

How do I do this? Is it done on the iPhone itself?

Reply