Question

Can 3rd party application access iPhone’s keychain in order to add X509 certificate to it? If yes, how can it be done?
If not, can it access keychain just to read certificates from it?

Basically, what I need is:
1) my application needs to access https site which uses certificate not signed by any trusted CA. when trying to connect via https, I get an exception.
2) it would be great If I could programmatically add the root’s certificate to the keychain; it would be sufficient if the user could access the site via Safari, accept its certificate, and then access the site using my application.

So far, I’ve been using the following interface to surpass https:

@interface NSURLRequest (DummyInterface)
+ (BOOL)allowsAnyHTTPSCertificateForHost:(NSString*)host;
+ (void)setAllowsAnyHTTPSCertificate:(BOOL)allow forHost:(NSString*)host;
@end

but this is not exactly what I want.

Any suggestions?

Answer 1

This Apple document should document enough stuff to permit adding self-signed certificate (or a self-signed certificate authority) into the keychain, and make it trusted. I didn’t test it, though. Source

See also the top answer on this question. It, however, doesn’t seem to actually verify the validity of the certificate. Cocoanetics has also documented how to use NSURLConnection with self-signed certificates, and similarly also doesn’t seem to verify the validity.

So, you almost certainly want to follow Apple’s instructions. The “Extracting and Evaluating an Identity From a *.P12 file” section appears to contain a complete example on how to import a certificate, even one protected with a passphrase.

Combine that with “AdvancedURLConnections” sample code and the ServerTrustChallengeHandler class and you should be good to go.

---

Here’s also a more complete example by Vanja Komadinović.