Thursday, January 29, 2009

Third party root certificates on the iPhone

For years I've run my own web server on one of my home systems.  I've got a home automation system with a web interface, I use the web interface in Azureus, etc.  Since I tend toward security, I have it all piped through SSL.  But, when I first started, the big vendors weren't offering cheap certs for individuals.  Fortunately, along came CACert, a provider of free certs usable by anyone.  The only drawback to a CACert is their root certificate isn't installed in any mainstream browser.  So, while the actual communications will be encrypted, you'll get a message when first entering your site that the cert can't be trusted.  It's a minor inconvenience, but the fix is even simpler than ignoring the problem: On your desktop, simply browse to CACert's site and click the link for "Root Certificate".  Click the link for "PEM Format" and the browser will ask if you're sure you want to trust certs from CA.  Select the applications you want to trust and hit Ok. 

When I tried to do this in Mobile Safari on my iPhone, I kept being told it couldn't download the PEM file. So, I did some searching and I found the solution: e-mail yourself the cert.  Follow the same steps as above, but instead of clicking the "PEM Format" link, you're going to want to right-click the "DER Format" link and use your browser's method of sending links.  When you get the e-mail open the attachment, accept that you trust the cert and you'll be good to go. 

While the solution was small, can you believe I had to compile it from three different sources to get it to work right? :)


No comments:

Post a Comment