iOS mTLS Client Certificate Authentication Fails in TestFlight with Error -25303
Problem
I'm building an iOS app that uses mTLS (client certificates received from server at runtime). Storing SecCertificate to keychain fails with error -25303 in both development and TestFlight builds, preventing SecIdentity creation needed for URLSession authentication.
Environment: iOS 18.2, iPad Pro, TestFlight internal testing, keychain-access-groups properly configured
Diagnostic Results
Testing keychain operations shows an interesting pattern:
✅ Generic Password - Works:
let addQuery: [CFString: Any] = [
kSecClass: kSecClassGenericPassword,
kSecAttrAccount: "test",
kSecValueData: "password".data(using: .utf8)!
]
SecItemAdd(addQuery as CFDictionary, nil) // Returns: 0 (success)
✅ SecKey - Works:
let addKeyQuery: [CFString: Any] = [
kSecClass: kSecClassKey,
kSecValueRef: privateKey,
kSecAttrApplicationTag: tag
]
SecItemAdd(addKeyQuery as CFDictionary, nil) // Returns: 0 (success)
❌ SecCertificate - Fails:
let addCertQuery: [CFString: Any] = [
kSecClass: kSecClassCertificate,
kSecValueRef: certificate, // Created from server-provided PEM
kSecAttrApplicationTag: tag
]
SecItemAdd(addCertQuery as CFDictionary, nil) // Returns: -25303
Code Context
Attempting to create SecIdentity for mTLS:
private func createIdentity(fromCert certPEM: String, key keyPEM: String) throws -> SecIdentity {
// 1. Parse PEM to DER and create SecCertificate - succeeds
guard let certData = extractPEMData(from: certPEM, type: "CERTIFICATE"),
let certificate = SecCertificateCreateWithData(nil, certData as CFData) else {
throw CertificateError.invalidCertificate
}
// 2. Parse PEM key and create SecKey - succeeds
guard let keyData = extractPEMData(from: keyPEM, type: "PRIVATE KEY"),
let privateKey = SecKeyCreateWithData(keyData as CFData, attrs as CFDictionary, &error) else {
throw CertificateError.invalidKey
}
// 3. Add key to keychain - SUCCEEDS (errSecSuccess)
let tempTag = UUID().uuidString.data(using: .utf8)!
SecItemAdd([
kSecClass: kSecClassKey,
kSecValueRef: privateKey,
kSecAttrApplicationTag: tempTag
] as CFDictionary, nil) // ✅ Works
// 4. Add certificate to keychain - FAILS (-25303)
let status = SecItemAdd([
kSecClass: kSecClassCertificate,
kSecValueRef: certificate,
kSecAttrApplicationTag: tempTag
] as CFDictionary, nil) // ❌ Fails with -25303
guard status == errSecSuccess else {
throw CertificateError.keychainError(status)
}
// 5. Would query for SecIdentity (never reached)
// ...
}
Network Behavior
When mTLS fails, console shows:
Connection: asked for TLS Client Certificates
Connection: received response for client certificates (-1 elements)
Connection: providing TLS Client Identity (-1 elements)
Task received response, status 403
The -1 elements indicates no certificates were provided.
Entitlements
<key>keychain-access-groups</key>
<array>
<string>$(AppIdentifierPrefix)com.ellin.tshios</string>
</array>
Keychain Sharing capability is enabled.
What I've Tried
Both kSecValueRef and kSecValueData approaches - same error
Various kSecAttrAccessible values - same error
Different keychain access groups - same error
TestFlight build (vs dev build) - same error
PKCS#12 creation - requires complex ASN.1/DER encoding, no iOS API
Questions
Is error -25303 expected when adding SecCertificate in development/TestFlight builds?
Will App Store distribution resolve this? Or is there a fundamental limitation?
Why does SecKey succeed but SecCertificate fails with identical entitlements?
Is there an alternative to create SecIdentity without keychain access?
Constraints
Certificates come from server at runtime (cannot bundle)
Need SecIdentity for URLSession client certificate authentication
Server provides PEM format certificates
Tested on: Simulator (dev), iPad Pro (dev), iPad Pro (TestFlight) - all fail
Any insights appreciated - specifically whether this is a provisioning profile limitation that App Store distribution would resolve.
