Can't install .der cert on the iOS programmatically

Question

I'm trying to programmatically install SSL certificate on the iOS(iPhone/iPhone simulator). I have successfully create and install .crt using this small guide! But when I try to convert obtained server.crt to server.der and install it programmatically I get CFNetwork SSLHandshake failed (-9807). Note that I use .der version of this cert on the iOS and .crt version on the OS X openssl server.

Converting:

openssl x509 -outform der -in server.crt -out server.der

Receiving on the OS X:

openssl s_server -key server.key -cert server.crt -accept 1678

Installing and sending on the iOS:

    NSBundle *bundle = [NSBundle bundleForClass:[self class]];
    NSData *iosTrustedCertDerData =
    [NSData dataWithContentsOfFile:[bundle pathForResource:@"certificate"
                                                    ofType:@"der"]];

    OSStatus            err = noErr;
    SecCertificateRef   cert;

    cert = SecCertificateCreateWithData(NULL, (CFDataRef) iosTrustedCertDerData);
    assert(cert != NULL);

    CFTypeRef result;

    NSDictionary* dict = [NSDictionary dictionaryWithObjectsAndKeys:
                          (id)kSecClassCertificate, kSecClass,
                          cert, kSecValueRef,
                          nil];

    err = SecItemAdd((CFDictionaryRef)dict, &result);
    assert(err == noErr || err == errSecDuplicateItem);

    printf("adding finished \n");


    if ((err == noErr) ||
        (err == errSecDuplicateItem)) {

        printf("success \n");

        CFReadStreamRef readStream;
        CFWriteStreamRef writeStream;
        CFStreamCreatePairWithSocketToHost(NULL,
                                           (CFStringRef)@"localhost",
                                           1678,
                                           &readStream,
                                           &writeStream);
        CFReadStreamSetProperty(readStream,
                                kCFStreamPropertySocketSecurityLevel,
                                kCFStreamSocketSecurityLevelTLSv1);
        CFReadStreamOpen(readStream);
        CFWriteStreamOpen(writeStream);

        UInt8 buf[] = "Hello from iOS\n";
        int bytesWritten = CFWriteStreamWrite(writeStream, buf, strlen((char*)buf));
}

So, how can I convert and install .der certificate on the iOS properly?

UPD:

 NSBundle *bundle = [NSBundle bundleForClass:[self class]];

    NSString *resourcePath = [bundle pathForResource:@"certificate" ofType:@"der"];

    NSData *certData = [NSData dataWithContentsOfFile:resourcePath];

    NSString* publickKeyRef = @"certificate_der";

    NSData* headerStrippedData = [self stripPublicKeyHeader:certData];
    [self addPeerPublicKey:publickKeyRef keyBits:headerStrippedData];

    SecKeyRef ref= [self getPublicKeyReference:publickKeyRef];

    printf("adding finished \n");


    CFReadStreamRef readStream;
    CFWriteStreamRef writeStream;
    CFStreamCreatePairWithSocketToHost(NULL,
                                       (CFStringRef)@"localhost",
                                       1678,
                                       &readStream,
                                       &writeStream);
    CFReadStreamSetProperty(readStream,
                            kCFStreamPropertySocketSecurityLevel,
                            kCFStreamSocketSecurityLevelTLSv1);
    CFReadStreamOpen(readStream);
    CFWriteStreamOpen(writeStream);

Exception occurs on this line:

[self addPeerPublicKey:publickKeyRef keyBits:headerStrippedData];

Exception:

*** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '*** setObjectForKey: object cannot be nil (key: v_Data)'
*** First throw call stack:
(
    0   CoreFoundation                      0x00a81a14 __exceptionPreprocess + 180
    1   libobjc.A.dylib                     0x00540e02 objc_exception_throw + 50
    2   CoreFoundation                      0x0096a174 -[__NSDictionaryM setObject:forKey:] + 948
    3   ssl2                                0x0006d8eb -[ViewController addPeerPublicKey:keyBits:] + 491
    4   ssl2                                0x0006e2dd -[ViewController viewDidLoad] + 397
    5   UIKit                               0x010932ae -[UIViewController _sendViewDidLoadWithAppearanceProxyObjectTaggingEnabled] + 44
    6   UIKit                               0x01097dce -[UIViewController loadViewIfRequired] + 1384
    7   UIKit                               0x010981ed -[UIViewController view] + 35
    8   UIKit                               0x00f45f94 -[UIWindow addRootViewControllerViewIfPossible] + 69
    9   UIKit                               0x00f466b1 -[UIWindow _setHidden:forced:] + 304
    10  UIKit                               0x00f46a67 -[UIWindow _orderFrontWithoutMakingKey] + 49
    11  UIKit                               0x00f5a118 -[UIWindow makeKeyAndVisible] + 80
    12  UIKit                               0x00ec26e7 -[UIApplication _callInitializationDelegatesForMainScene:transitionContext:] + 4190
    13  UIKit                               0x00ec9cd6 -[UIApplication _runWithMainScene:transitionContext:completion:] + 1989
    14  UIKit                               0x00eeeee5 __84-[UIApplication _handleApplicationActivationWithScene:transitionContext:completion:]_block_invoke3218 + 68
    15  UIKit                               0x00ec6966 -[UIApplication workspaceDidEndTransaction:] + 163
    16  FrontBoardServices                  0x0373fc76 __37-[FBSWorkspace clientEndTransaction:]_block_invoke_2 + 71
    17  FrontBoardServices                  0x0373f74d __40-[FBSWorkspace _performDelegateCallOut:]_block_invoke + 54
    18  FrontBoardServices                  0x0375d173 -[FBSSerialQueue _performNext] + 184
    19  FrontBoardServices                  0x0375d5aa -[FBSSerialQueue _performNextFromRunLoopSource] + 52
    20  FrontBoardServices                  0x0375c8a6 FBSSerialQueueRunLoopSourceHandler + 33
    21  CoreFoundation                      0x0099b6ff __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 15
    22  CoreFoundation                      0x0099138b __CFRunLoopDoSources0 + 523
    23  CoreFoundation                      0x009907a8 __CFRunLoopRun + 1032
    24  CoreFoundation                      0x009900e6 CFRunLoopRunSpecific + 470
    25  CoreFoundation                      0x0098fefb CFRunLoopRunInMode + 123
    26  UIKit                               0x00ec6206 -[UIApplication _run] + 540
    27  UIKit                               0x00ecbbfa UIApplicationMain + 160
    28  ssl2                                0x0006e91a main + 138
    29  libdyld.dylib                       0x0310ba21 start + 1
)
libc++abi.dylib: terminating with uncaught exception of type NSException

Your certificate is probably not quite correct if that's how you are creating it. ***`CN=example.com`*** is probably wrong. Hostnames always go in the *SAN*. If its present in the *CN*, then it must be present in the *SAN* too (you have to list it twice in this case). For more rules and reasons, see [How do you sign Certificate Signing Request with your Certification Authority](http://stackoverflow.com/a/21340898/608639) and [How to create a self-signed certificate with openssl?](http://stackoverflow.com/q/10175812/608639) — jww, Sep 29 '16 at 22:06
@jww I already tried this, please check [this topic](http://stackoverflow.com/questions/39239817/cfnetwork-sslhandshake-failed-9807-on-ios-simulator-with-localhost). — konstantin_doncov, Sep 30 '16 at 13:30

prabodhprakash · Answer 1 · 2016-09-29T18:40:53.887

In iOS, its a bit different, you need to add this .der file to your keychain and then refer it back from your key chain. I am giving the code below to add and get back from keychain

- (void)addPeerPublicKey:(NSString *)peerName keyBits:(NSData *)publicKeyData {

    OSStatus sanityCheck = noErr;
    CFTypeRef persistPeer = NULL;
    [self removePeerPublicKey:peerName];

    NSData * peerTag = [[NSData alloc] initWithBytes:(const void *)[peerName UTF8String] length:[peerName length]];
    NSMutableDictionary * peerPublicKeyAttr = [[NSMutableDictionary alloc] init];
    [peerPublicKeyAttr setObject:(id)kSecClassKey forKey:(id)kSecClass];
    [peerPublicKeyAttr setObject:(id)kSecAttrKeyTypeRSA forKey:(id)kSecAttrKeyType];
    [peerPublicKeyAttr setObject:peerTag forKey:(id)kSecAttrApplicationTag];
    [peerPublicKeyAttr setObject:publicKeyData forKey:(id)kSecValueData];
    [peerPublicKeyAttr setObject:[NSNumber numberWithBool:YES] forKey:(id)kSecReturnData];
    sanityCheck = SecItemAdd((CFDictionaryRef) peerPublicKeyAttr, (CFTypeRef *)&persistPeer);

    if(sanityCheck == errSecDuplicateItem)
    {
        NSLog(@"HanselErrorCode: -1");
    }

    persistPeer = NULL;
    [peerPublicKeyAttr removeObjectForKey:(id)kSecValueData];
    sanityCheck = SecItemCopyMatching((CFDictionaryRef) peerPublicKeyAttr, (CFTypeRef*)&persistPeer);

    if (persistPeer) CFRelease(persistPeer);
}

-(SecKeyRef)getPublicKeyReference:(NSString*)peerName
{
    OSStatus sanityCheck = noErr;

    SecKeyRef pubKeyRefData = NULL;
    NSData * peerTag = [[NSData alloc] initWithBytes:(const void *)[peerName UTF8String] length:[peerName length]];
    NSMutableDictionary * peerPublicKeyAttr = [[NSMutableDictionary alloc] init];

    [peerPublicKeyAttr setObject:(id)kSecClassKey forKey:(id)kSecClass];
    [peerPublicKeyAttr setObject:(id)kSecAttrKeyTypeRSA forKey:(id)kSecAttrKeyType];
    [peerPublicKeyAttr setObject:peerTag forKey:(id)kSecAttrApplicationTag];
    [peerPublicKeyAttr setObject:[NSNumber numberWithBool:YES] forKey:       (id)kSecReturnRef];
    sanityCheck = SecItemCopyMatching((CFDictionaryRef) peerPublicKeyAttr, (CFTypeRef*)&pubKeyRefData);

    if(pubKeyRefData)
    {
        return pubKeyRefData;
    }
    else
    {
        return nil;
    }
}

- (NSData *)stripPublicKeyHeader:(NSData *)d_key
{
    // Skip ASN.1 public key header
    if (d_key == nil) return(nil);

    unsigned int len = (unsigned int)[d_key length];
    if (!len) return(nil);

    unsigned char *c_key = (unsigned char *)[d_key bytes];
    unsigned int  idx    = 0;

    if (c_key[idx++] != 0x30) return(nil);

    if (c_key[idx] > 0x80) idx += c_key[idx] - 0x80 + 1;
    else idx++;

    // PKCS #1 rsaEncryption szOID_RSA_RSA
    static unsigned char seqiod[] =
    { 0x30,   0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
        0x01, 0x05, 0x00 };
    if (memcmp(&c_key[idx], seqiod, 15)) return(nil);

    idx += 15;

    if (c_key[idx++] != 0x03) return(nil);

    if (c_key[idx] > 0x80) idx += c_key[idx] - 0x80 + 1;
    else idx++;

    if (c_key[idx++] != '\0') return(nil);

    // Now make a new NSData from this buffer
    return([NSData dataWithBytes:&c_key[idx] length:len - idx]);

}


- (void)removePeerPublicKey:(NSString *)peerName
{
    OSStatus sanityCheck = noErr;

    NSData * peerTag = [[NSData alloc] initWithBytes:(const void *)[peerName UTF8String] length:[peerName length]];
    NSMutableDictionary * peerPublicKeyAttr = [[NSMutableDictionary alloc] init];

    [peerPublicKeyAttr setObject:(__bridge id)kSecClassKey forKey:(__bridge id)kSecClass];
    [peerPublicKeyAttr setObject:(__bridge id)kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    [peerPublicKeyAttr setObject:peerTag forKey:(__bridge id)kSecAttrApplicationTag];

    sanityCheck = SecItemDelete((__bridge CFDictionaryRef) peerPublicKeyAttr);
}

And to use this key, you will have to do below

NSString *resourcePath = [bundle pathForResource:@"publickey" ofType:@"der"];
    NSData *certData = [NSData dataWithContentsOfFile:resourcePath];

    NSData* headerStrippedData = [self stripPublicKeyHeader:certData];
    [self addPeerPublicKey:publickKeyRef keyBits:headerStrippedData];

    SecKeyRef ref= [self getPublicKeyReference:publickKeyRef];

and finally use ref for all your purposes.

NSString* publickKeyRef = @"key_name_against_which_you_want_to_save_your_der";

This code shows you way to add it, get it back and use it. I took this code from internet some months back - add link to source, if you find one. In Xcode8 , you will have to add the name of keychain(publickKeyRef) against which you will use this der file in capabilities section.

Many thanks for your answer! I just don't understand one thing: what I need to use as `publickKeyRef`? Sorry if this is obvious - I'm a newbie in the iOS. — konstantin_doncov, Sep 29 '16 at 18:39
Okay, I got your question now and made changes to my answer. — prabodhprakash, Sep 29 '16 at 18:40
Unfortunately no, I still don't know what exactly I need to do, but I tried to suggest it and got an exception. Please check my **UPD** section in the post to check my code(please, note that I, of course, added your 4 additional methods but I just don't describe this in the question) and exception. — konstantin_doncov, Sep 30 '16 at 13:48
please could you tweet me at - localtestserver - I'll help you, hard to debug here and I do not know, how to start chat here (unless SO offers itself). We'll post solution, if found, back to SO her for everyone else to see — prabodhprakash, Sep 30 '16 at 15:19
Ok, I'll tweet you later, but I think problem simpler than you think. Did you try just check the sequence of commands in the my code? — konstantin_doncov, Sep 30 '16 at 16:39

Can't install .der cert on the iOS programmatically

1 Answers1