通过自定义CA证书进行证书交换时，通过SSL进行的iOS 12 App REST调用失败

Question

I am working on the server side of a system here, but I have an iOS question. There is a team (Different time zone, so not online now) who are calling a REST API I provide, using an iOS app. iOS 12, I am pretty sure. They mailed me earlier to say that it's "Hanging" and send me the following log. I know iOS doesn't like self-signed certs, so I made a custom CA, and signed a cert for my server. I sent them the Custom CAs, (Issuing and Root) and they appear to have installed them correctly as profiles on iOS. Does the trace below make any sense to anyone? I know this a bit hand-wavy, but we are up against the wire on a regulatory project, and I'd really appreciate any insight that I could offer to my App Development friends.

Error Domain=org.openid.appauth.general Code=-5 "(null)" UserInfo={NSUnderlyingError=0x280d86bb0 {Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSURLErrorFailingURLPeerTrustErrorKey=<SecTrustRef: 0x2831eb180>, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9802, NSErrorPeerCertificateChainKey=(

"<cert(0x13e094e00) s: rhaxwayvd1.mid.xxx i: XXX plc Issuing CA 1>",

"<cert(0x13e095800) s: XXX plc Issuing CA 1 i: XXX plc Root CA>",

"<cert(0x13e096200) s: XXX plc Root CA i: XXX plc Root CA>"

), NSUnderlyingError=0x280d85b30 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x2831eb180>, _kCFNetworkCFStreamSSLErrorOriginalValue=-9802, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9802, kCFStreamPropertySSLPeerCertificates=(

"<cert(0x13e094e00) s: rhaxwayvd1.mid.xxx i: XXX plc Issuing CA 1>",

"<cert(0x13e095800) s: XXX plc Issuing CA 1 i: AIB plc Root CA>",

"<cert(0x13e096200) s: XXX plc Root CA i: AIB plc Root CA>"

)}}, NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., NSErrorFailingURLKey=https://rhaxwayvd1.mid.xxx:8445/XXXApp/TokenExchange, NSErrorFailingURLStringKey=https://rhaxwayvd1.mid.xxx:8445/XXXApp/TokenExchange, NSErrorClientCertificateStateKey=0}}}

Answer 1

OK, lack of knowledge on my part, but I'll post the answer, in case it helps someone in future. Although I mailed the Custom CA Cert to the iOS tester, and he installed it as a profile, that's not enough. It is necessary to specify that you trust this CA on the device. This is done by navigating on the device settings to:

settings->general->about->Certificate Trust Settings

There you will see the newly installed Custom CA. It is switched off by default, so needs to be switched on.