All looks good, doesn’t it? And in most cases – it will even work fine. Unless your server handles the handshake, something goes wrong and you look at what happens on the wire:<\/p>\n
Can you see what happens here? The client certificate is sent twice. That is not always an issue, but if your server is parsing the certificates, and expects them to be in order, and expects that the first one is the client certificate and what follows is the issuer… you are in trouble.<\/p>\n You may argue whether this is a client bug or the server issue… I would say the client should be fixed. Per\u00c2\u00a0RFC2246<\/a> and RFC5246<\/a> the certificate structure should contain sender’s cert once.<\/p>\n certificate_list So how do we fix it? Fortunately the fix is trivial. Change this line:<\/p>\n NSURLCredential *credential = [NSURLCredential credentialWithIdentity:identityApp certificates:(__bridge NSArray *)myCerts<\/strong> persistence:NSURLCredentialPersistencePermanent];<\/p>\n to this:<\/p>\n NSURLCredential *credential = [NSURLCredential credentialWithIdentity:identityApp certificates:nil<\/strong> persistence:NSURLCredentialPersistencePermanent];<\/p>\n And everybody is happy again. The app sends a single certificate only, no change on the server required.<\/p>\n","protected":false},"excerpt":{"rendered":" Here’s another one on certificates. Let’s say you are trying to do client certificate-based authentication in your iOS app and you came up with something like this: – (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge { if ([challenge previousFailureCount] > 0) { NSLog(@"Incorrect auth challenge %@", challenge); [[challenge sender] cancelAuthenticationChallenge:challenge]; return; } \/\/ Checking the server certificate if … Czytaj dalej \u201eThe curious case of duplicated certificates sent by iOS\u201d<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[13],"tags":[],"class_list":["post-207","post","type-post","status-publish","format-standard","hentry","category-mdm-en"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p217OK-3l","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/oso.com.pl\/index.php?rest_route=\/wp\/v2\/posts\/207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oso.com.pl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/oso.com.pl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/oso.com.pl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/oso.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=207"}],"version-history":[{"count":16,"href":"https:\/\/oso.com.pl\/index.php?rest_route=\/wp\/v2\/posts\/207\/revisions"}],"predecessor-version":[{"id":224,"href":"https:\/\/oso.com.pl\/index.php?rest_route=\/wp\/v2\/posts\/207\/revisions\/224"}],"wp:attachment":[{"href":"https:\/\/oso.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/oso.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/oso.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"iOS](\"http:\/\/oso.com.pl\/wp-content\/uploads\/2013\/05\/ios_certs.png\")
<\/a><\/p>\n
\nThis is a sequence (chain) of X.509v3 certificates. The sender’s
\ncertificate must come first in the list. Each following
\ncertificate must directly certify the one preceding it. Because
\ncertificate validation requires that root keys be distributed
\nindependently, the self-signed certificate which specifies the
\nroot certificate authority may optionally be omitted from the
\nchain, under the assumption that the remote end must already
\npossess it in order to validate it in any case.
\nThe same message type and structure will be used for the client’s
\nresponse to a certificate request message. Note that a client may
\nsend no certificates if it does not have an appropriate certificate
\nto send in response to the server’s authentication request.<\/em><\/p>\n