Is it possible to generate a certificate signing request (.csr) using the security infrastructure in ios?

Question

I would like to make an https request with a server requiring client certificate authentication. I reviewed this Create SecCertificateRef for the NSURLConnection authentication task . It worked as expected.

However, he needs to prepare the p12 file, which includes the private key. It would be saved since it needs a password to import the p12 file using SecPKCS12Import() .

However, there may be another option. This means that the ios client must fulfill the certificate signing request (.CSR) and allow a third party (this is the server) to sign it.

In my search, I see that I can use SecKeyGeneratePair() to generate a key pair. But I do not see the API that CSR generates.

Do you really need openssl to achieve this?

In addition, the theme is turned off a bit after the iOS client somehow returns the signed certificate. I can use SecCertificateCreateWithData() to retrieve SecCertificateRef() . However, to fill out a NSURLCredential . I also need a SecIdentityRef that comes from the p12 file using SecPKCS12Import() . How can I restore a SecIdentityRef without SecPKCS12Import() , but just a certificate file like crt or der ?

Answer 1

There is no explicit support for CSR in the Security Framework on iOS. However, creating CSR manually is not so difficult - it is just an ASN.1 DER data block available in the iOS runtime.

Here is the pseudo code for this:

• Use SecKeyGeneratePair() from the Security Framework to create a new public / private key
• Implement the getPublicKeyBits method to get the NSData form of the new public key (see https://developer.apple.com/library/ios/samplecode/CryptoExercise/Introduction/Intro.html )
• getPrivateKey method to retrieve SecKeyRef from Keychain
• Follow http://www.ietf.org/rfc/rfc2986.txt to create the ASN.1 DER CSR in NSMutableData li>
• Use CC_SHA1_ * to create a hash of the certification request information (part of CSR)
• Use SecKeyRawSign and private key to sign CSR

This will create the correct CSR (in the form of NSData), which can be sent to the CA for approval.

My implementation is available on GitHub: http://github.com/ateska/ios-csr .