Needed details on Certificate validations mentioned in App Security TechNote?

Question

Created Aug ’15

Replies 5

Boosts 0

Participants 2

Reference: https://developer.apple.com/library/prerelease/ios/technotes/App-Transport-Security-Technote/

"Certificates must use at least an SHA256 fingerprint with either a 2048 bit or greater RSA key, or a 256 bit or greater Elliptic-Curve (ECC) key."

In a typical communication from the iOS app to any server using SSL, there will be chain of certificates being involved.

Do we need to ensure the above suggested certificate compliance on all of the certificates involved from the Leaf, all the intermediary, and the Root CA certificates? Or what specific checks needed on each of these different type of certificates?

Thanks,

Rajesh

Boost

Answer 1

DTS Engineer OP

Apple

Aug ’15

Accepted Answer

Do we need to ensure the above suggested certificate compliance on all of the certificates involved from the Leaf, all the intermediary, and the Root CA certificates?

No. These requirements apply just to the leaf certificate.

Share and Enjoy
—
Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

1

Answer 2

rajeshkr OP

Aug ’15

Thanks for your reply, and it really helped validate our case.

Also, Could you provide the actual trusted root CA certificates (actual certificates) for either iOS8 or iOS9?

Thanks,

Rajesh.

0

Answer 3

DTS Engineer OP

Apple

Aug ’15

Also, Could you provide the actual trusted root CA certificates (actual certificates) for either iOS8 or iOS9?

The iOS 8 list is published by AppleCare as List of available trusted root certificates in iOS 8.

I fully expect that they will publish an equivalent article for iOS 9 once it’s all done but, as I don’t work for AppleCare, I can’t make commitments on their behalf.

Share and Enjoy
—
Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 4

rajeshkr OP

Aug ’15

Thanks for pointing me to the ios8 trusted cert list.

As JAVA SDK provides the default trusted certificate files in location: JAVA_HOME/jre/lib/security/cacerts.

Similarly looking for options to obtain the list of certificates trusted by iOS8 or 9.

Thanks,

Rajesh.

0

Answer 5

DTS Engineer OP

Apple

Aug ’15

I addressed this point in my response to your other thread.

Share and Enjoy
—
Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0