Certificates Issued by Internal Enterprise CA Not Trusted on Apple iOS

Issue

A certificate issued by a private Certification Authority (CA) is not trusted on an iOS device, despite appearing valid on Windows systems.

Users may receive certificate trust warnings when accessing websites, services, or applications that use certificates issued by the private CA.



Cause

This issue can occur for one of the following reasons:

  1. The Root CA certificate has not been installed and trusted on the iOS device.


  2. The end-entity certificate contains an extension that has been marked as Critical, but iOS does not understand or process the data contained within that extension.

If iOS encounters a critical extension that it cannot parse, the certificate will not be trusted even if the Root CA certificate has been installed correctly.



Resolution

Install and trust the Root CA certificate on the iOS device.

  1. Download a copy of the Root CA certificate and save it to the Files app on the iOS device.

  2. Open the certificate file from the Files app. A message will indicate that a profile has been downloaded.

  3. Navigate to Settings > General > Profiles and install the downloaded profile.

  4. Return to Settings > General and open the About section.

  5. Scroll to Certificate Trust Settings.

  6. Enable full trust for the Root CA certificate.

If the certificate is still not trusted after installing and trusting the Root CA certificate, inspect the end-entity certificate on the iOS device.

  1. View the certificate details and look for extensions containing unparsed data.

  2. Identify any extensions that are marked as Critical.

  3. If a critical extension contains unparsed data, issue a new certificate and ensure that the extension is not marked as Critical.

Additional Information

This issue was verified on iOS 13.1.3 (iPhone 8).

iOS requires explicit trust of privately issued Root CA certificates. Installing the certificate alone is not sufficient; full trust must also be enabled through the Certificate Trust Settings menu.

When troubleshooting trust issues, examine certificate extensions carefully. An otherwise valid certificate may be rejected if iOS encounters a critical extension that it cannot interpret. In this particular case, the extension was

Date Created: Saturday, 26 October 2019, 6:32 PM