How to install self signed certificate in iOS 10

Question

It appears that Apple has removed the ability to trust SSL certificates that are self-signed in iOS 10.

I created my own self-signed certificate and have a local web server that signed with my certificate. I must install my certificate in iOS for testing locally as I have developed an iOS application that needs to trust my certificate.

How can I install my self-signed certificate?

Answer 1

Good news, they haven't. If you just need this for development purposes, which it sounds like you do (and you shouldn't be using self-signed certificates in production anyway), you can install the self-signed certificate on your iOS devices manually. Following the equivalent FAQ for my iOS Web Bluetooth browser app:

1. Create your self-signed certificate and key files using openssl or however. Be sure it has the correct /CN “Common Name” for your local server, e.g. mycomputer.local.
2. Configure your webserver to use it (obviously) and check that it is working using a different client, such as a browser on a Mac.
3. Email your certificate to an email address you can access on your iOS device.
4. Tap on the attachment in Mail on your iOS device, this should now prompt you to install it. Do so.
5. You should now verify that it is installed by going to the Settings app then General -> Profile -> <Common Name>. The Profile menu probably won’t be there at all until you’ve installed the first certificate. The certificate should be marked Verified (it was verified by you when you installed it).
6. You might, like I did, have thought this would be enough. It isn’t. You now, really counter-intuitively, need to go to the setting General -> About -> Certificate Trust Settings and enable full trust for your certificate there as well. It’s such a weird place for that setting to be.

Answer 2

The installation of own root certificates changed at some point (maybe somebody can confirm, if it was at iOS 11).

What you need to do is with your Mac, get Apple Configurator 2 and create a profile containing your certificate. The resulting mobile profile file can be installed from Safari or email.