可以在itms-services中使用自签名SSL证书

Question

I'm trying to install a beta app to an iOS device and am hosting the manifest.plist and IPA file on HTTPS with a self-signed certificate. When I hit the itms-services:// link, I get an error of "Cannot connect to <ip address>".

itms-services link:

itms-services://?action=download-manifest&url=https://10.0.1.2:1338/ipa/manifest.plist

plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>items</key>
    <array>
        <dict>
            <key>assets</key>
            <array>
                <dict>
                    <key>kind</key>
                    <string>software-package</string>
                    <key>url</key>
                    <string>https://10.0.1.2:1338/ipa/test.ipa</string>
                </dict>
            </array>
            <key>metadata</key>
            <dict>
                <key>bundle-identifier</key>
                <string>com.company.test</string>
                <key>bundle-version</key>
                <string>1.0</string>
                <key>kind</key>
                <string>software</string>
                <key>title</key>
                <string>test</string>
            </dict>
        </dict>
    </array>
</dict>
</plist>

Answer 1

Try adding your certificate to the trusted ones (probably, easiest thing to do is to mail a cer file to device and open it from standard mail app to install).

Another thing you need to make sure is that your server supports TLS 1.2 and Forward Secrecy.

You can use nscurl --ats-diagnostics https://example.com/app.ipa to check if everything done right.

Answer 2

Its possible:

1. Create the certificate file (export as DER encode X.509)
2. Access file from device via HTTP (like the manifest.plist in your example)
3. Agree to install it in device
4. Turn it on: https://support.apple.com/en-au/HT204477