Question

I want to import a SSL certificate into my Application’s keychain. I got a sample project from apple and I tested it. I am sure that technically it can be done. But my question is that, what kind of approach should I use while asking the client to install the certificate. I thought about the following options,

->Prompting the user to install the credentials at the application launch.

->Maintaining a settings page to control the credentials.

As my application totally depends upon web services I cannot proceed without the credentials. Please post your suggestions.

Answer 1

Ask your certificate provider for a link to download the certificate. Just Download and Store the certificate in your resources folder.

The below set of code snippets will do the work for you. Please post comments if you don’t understand the below.

 SecIdentityRef identity = NULL;
    SecTrustRef trust = NULL;

    NSData *PKCS12Data = [NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"test_iphone_services" ofType:@"p12"]];

//Calling the method
[Child extractIdentity:&identity andTrust:&trust fromPKCS12Data:PKCS12Data]

    + (BOOL)extractIdentity:(SecIdentityRef *)outIdentity andTrust:(SecTrustRef*)outTrust fromPKCS12Data:(NSData *)inPKCS12Data
    {
        OSStatus securityError = errSecSuccess;
//testtest is the passsword for the certificate.
        NSDictionary *optionsDictionary = [NSDictionary dictionaryWithObject:@"testtest" forKey:(id)kSecImportExportPassphrase];

        CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
        securityError = SecPKCS12Import((CFDataRef)inPKCS12Data,(CFDictionaryRef)optionsDictionary,&items);

        if (securityError == 0) { 
            CFDictionaryRef myIdentityAndTrust = CFArrayGetValueAtIndex (items, 0);
            const void *tempIdentity = NULL;
            tempIdentity = CFDictionaryGetValue (myIdentityAndTrust, kSecImportItemIdentity);
            *outIdentity = (SecIdentityRef)tempIdentity;
            const void *tempTrust = NULL;
            tempTrust = CFDictionaryGetValue (myIdentityAndTrust, kSecImportItemTrust);
            *outTrust = (SecTrustRef)tempTrust;

        } else {
            NSLog(@"Failed with error code %d",(int)securityError);
            return NO;
        }

        return YES;
    }

    #pragma mark - NSURLConnection Delegate Methods
    - (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace {
        return [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate];
    }

    - (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
        NSLog(@"trust %@", trust);
        NSURLCredential *credential;
        NSURLCredentialPersistence  persistence;
        persistence = NSURLCredentialPersistencePermanent;
        credential = [NSURLCredential credentialWithIdentity:identity certificates:nil persistence:persistence];

        NSLog(@"credential %@", credential);
     [challenge.sender useCredential:credential forAuthenticationChallenge:challenge];

    }