Background
We need to sync corporate contacts to native iOS Apple Contacts via CardDAV, restricted strictly to company-managed devices using mTLS (deployed via .mobileconfig).
Problem
The backend sits behind an AWS ALB with native mTLS enabled (Verify with trust store).
However, ALB logs show that the iOS client fails to present the client certificate during the TLS handshake, causing the ALB to reject the connection (leaf_client_cert_subject: - (empty client cert offered during handshake).
What I Have Verified & Tried
-
In .mobileconfig, I declared both com.apple.security.pkcs12 and com.apple.carddav.account. However, there seems to be no fields to link the pkcs12 to the carddav account.
-
Installed Root CA on iOS -> Settings > General > About > Certificate Trust Settings > Enabled "Full Trust For Root Certificates".
-
I check the CardDAV UI but there is nowhere to add client certificate.
Questions
How to implement mTLS on native iOS Apple Contacts via CardDAV?
I don’t think we’ll be able to help you here on the Apple Developer Forums. Our focus is on helping developers use Apple APIs and tools to create products for Apple platforms. We’re not really set up to help folks use Apple products, and that includes advanced use cases like yours.
You might have better luck asking this question over in the Apple Support Community, run by Apple Support, and specifically in the Business and Education topic area. If that doesn’t pan out, I recommend that you contact Apple Support directly.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"