iOS checks if root certificate is installed *and* trusted

Aluminum Gallium

Our app is installing the root CA profile and I want to verify that it is installed and trusted by the user.

For now, this is roughly what we do (pruned for the core)

SecPolicyRef policyObj = SecPolicyCreateBasicX509();
SecTrustRef trustObj;
OSStatus error = SecTrustCreateWithCertificates((__bridge CFTypeRef _Nonnull)(fullChain), policyObj, &trustObj);

SecTrustResultType result;
error = SecTrustEvaluate(trustObj, &result);

CFRelease(trustObj);
CFRelease(policyObj);

return (kSecTrustResultUnspecified == result || kSecTrustResultProceed == result);

The problem is that once the profile is installed, the result is either kSecTrustResultUnspecified (iOS 10~) or kSecTrustResultProceed (iOS 11~), but I want to check if the user trusts it (under General->About->Trust Settings)

I dug into Apple's documentation and found nothing, and in the SecTrustEvaluate documentation it says that the return value "continue" means the user trusts the certificate.

proceed— The user explicitly chose to trust a certificate in the chain (usually by clicking a button in a certificate trust panel).

Anyone know how to do this? What am I missing?

Aluminum Gallium

So after googling around, I found that SecPolicyCreateSSL works as expected, but still not 100% why SecPolicyCreateBasicX509 doesn't.

So, for future reference, here is what we did if anyone encounters this problem,

SecPolicyRef policy = SecPolicyCreateSSL(true, NULL);
SecTrustRef testTrust;

OSStatus status = SecTrustCreateWithCertificates((__bridge CFArrayRef)fullChain, policy, &testTrust);
status = SecTrustEvaluate(testTrust, &trustResult);

CFRelease(testTrust);
CFRelease(policy);

return (status == errSecSuccess) && (kSecTrustResultUnspecified == trustResult || kSecTrustResultProceed == trustResult);;

(basically use SecPolicyCreateSSL instead)

Related

iOS checks if root certificate is installed *and* trusted

Aluminum Gallium Our app is installing the root CA profile and I want to verify that it is installed and trusted by the user. For now, this is roughly what we do (pruned for the core) SecPolicyRef policyObj = SecPolicyCreateBasicX509(); SecTrustRef trustObj; O

Should trusted root CAs be part of the certificate chain?

Mike I am establishing 2-way SSL communication between services on different hosts. Suppose I have a CA of my own, called A. All my services trust A through centralized jks. Now suppose I have a certificate B signed by A. When services send certificates, shoul

Install Self Signed Certificate as Trusted Root on Windows XP

jospe I have successfully installed a self signed certificate to Windows7. The process is to install it to the Trusted Root Certification Authorities (the local computer) first, and then install it to the trusted people (the local computer). (Without installin

Install Self Signed Certificate as Trusted Root on Windows XP

jospe I have successfully installed a self signed certificate to Windows7. The process is to install it to the Trusted Root Certification Authorities (the local computer) first, and then install it to the trusted people (the local computer). (Without installin

How to remove the root CA certificate installed by Fiddler

Mozamo Fiddler helpfully provides the ability to add a unique root CA certificate to intercept HTTPS traffic. After adding this certificate, how can I remove it? Eyal Abir As of Fiddler 4.6.1.5, the GUI is different. Go to Tools -> Fiddler Options -> HTTPS. Th

How to remove the root CA certificate installed by Fiddler

Mozamo Fiddler helpfully provides the ability to add a unique root CA certificate to intercept HTTPS traffic. After adding this certificate, how can I remove it? Eyal Abir As of Fiddler 4.6.1.5, the GUI is different. Go to Tools -> Fiddler Options -> HTTPS. Th

How to remove the root CA certificate installed by Fiddler

Mozamo Fiddler helpfully provides the ability to add a unique root CA certificate to intercept HTTPS traffic. After adding this certificate, how can I remove it? Eyal Abir As of Fiddler 4.6.1.5, the GUI is different. Go to Tools -> Fiddler Options -> HTTPS. Th

How to remove the root CA certificate installed by Fiddler

Mozamo Fiddler helpfully provides the ability to add a unique root CA certificate to intercept HTTPS traffic. After adding this certificate, how can I remove it? Eyal Abir As of Fiddler 4.6.1.5, the GUI is different. Go to Tools -> Fiddler Options -> HTTPS. Th

SSL certificate not trusted - intermediate certificate

quark When I check my website through Digicert it says the SSL certificate is not trusted This is the configuration for NGINX server { listen 80; listen 443 default_server ssl; server_name ~. ""; location / { proxy_pass http://localhost

SSL certificate not trusted - intermediate certificate

quark When I check my website through Digicert it says the SSL certificate is not trusted This is the configuration for NGINX server { listen 80; listen 443 default_server ssl; server_name ~. ""; location / { proxy_pass http://localhost

Gradle: No trusted certificate found

OBit： I'm trying to build my Android project on Ubuntu-Server using Gradle. Building with Android-Studio on Windows 10 PC works fine But use ./gradlew buildor ./gradlew cleanfails with the following output: FAILURE: Build failed with an exception. * What went

my ssl certificate is not trusted

b4rt3kk： I have made the certificate on the server using the following command: sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt and configure everything correctly, when typing https