HTML5 Video on IPad Safari using HTTPS

Question

I'm trying to play an .mp4 video on an iPad (Safari browser) using the HTML 5 video element. Everything works fine using HTTP. However, the video will not load (or play) when accessed using HTTPS. If I access the same web site from my Desktop Chrome browser, I can load and play the video using HTTPS. There are hints elsewhere on the Web about Quicktime and HTTPS not working on the iPad. Is this the same issue?

Answer 1

The SSL certificate you are using probably was not issued by a trusted Root Certificate Authority (or CA) of iOS/Safari.

SSL certificates nowadays are most-likely issued by "Intermediate CAs".
That is, a CA that's trusted by the root CA.
However, your browser/OS knows nothing about that.
It only knows that your SSL certificate was issued by a CA that it doesn't trust.

So you have to let iOS/Safari know that your intermediate CA is actually trusted by the root CA that Safari trusts.

So you need to download the Intermediate Certificate from your CA, and install that Intermediate Certificate on your server, in order for Safari/iOS to play your HTTPS video (HTTPS = HTTP via SSL).

In case your CA is a CA that's trusted by a CA that's trusted by a root CA, you'll need to install the second intermediate certificate as well. Generally speaking, if you're CA's trust level is chained N times, you need to put all N certificates on your server.

In order to chain your certificates:

cat certfile1 certfile2 ... certfileN > www.YOUR_DOMAIN.com.chained.crt

e.g.

cat www.example.com.crt intermediary.crt > www.example.com.chained.crt

Then you put the chained certificate into the virtual server's configuration file (this is for nginx):

server {
    listen              443 ssl;
    server_name         www.example.com;
    ssl_certificate     www.example.com.chained.crt;
    ssl_certificate_key www.example.com.key;
    ...
}

And just in case you're young and naïve:
SSL Certificate Chain order matters
(to some very, very picky SSL implementations)

The order should be:

<your certificate>
<your cert signer>
<signer for your cert signer>
<etc>