Can you add your own CA cert to your device?
Yes.
iOS 18 breaks IMAPS self-signed certs
11–20 of 157 posts
Re: iOS 18 breaks IMAPS self-signed certs
#12Can you add your own CA cert to your device?
Yes, I have a private CA I install on all my Apple devices for my self-signed certs. After I have the root CA on the device, it looks like any other valid SSL to iOS / macOS.
Re: iOS 18 breaks IMAPS self-signed certs
#13https://developer.apple.com/forums/thread/732409 (fixed url) seems like the issue is specifically with IMAP- I can confirm that calendar syncing works fine with the self signed cert. this is really disappointing.
[deleted]
Re: iOS 18 breaks IMAPS self-signed certs
#14It's 2024, PKI best practices are well known and well documented, anybody still using a self-signed certs on their mail server (or anywhere) is either lazy or stupid.
Plenty of existing applications will refuse to connect to a self-signed certificate on the belief that allowing the end-user to confirm a certificate offers basically 0 protection against malicious actors.
Re: iOS 18 breaks IMAPS self-signed certs
#15Can you add your own CA cert to your device?
At least with Safari all my internal SSL web services work properly on iOS with the root cert installed. Not sure about IMAP.
Re: iOS 18 breaks IMAPS self-signed certs
#16It's 2024, PKI best practices are well known and well documented, anybody still using a self-signed certs on their mail server (or anywhere) is either lazy or stupid. Plenty of existing applications will refuse to connect to a self-signed certificate on the belief that allowing the end-user to confirm a certificate offers basically 0 protection against malicious actors.
explain how a pinned self signed cert is insecure. i don't see it. it would seem to be more secure than one signed by a public CA that's not pinned.
Re: iOS 18 breaks IMAPS self-signed certs
#17Re: iOS 18 breaks IMAPS self-signed certs
#18I switched to letsencrypt certs for my imap server. Works well, IMO better than the self-signed ones I used before.
I'm using a private ip over a vpn so I don't think that workaround will work for me. I don't really want a public dns record.
If so, then you might want to mint your own root certificate and then import it to your iPhone.
Re: iOS 18 breaks IMAPS self-signed certs
#19It's 2024, PKI best practices are well known and well documented, anybody still using a self-signed certs on their mail server (or anywhere) is either lazy or stupid. Plenty of existing applications will refuse to connect to a self-signed certificate on the belief that allowing the end-user to confirm a certificate offers basically 0 protection against malicious actors.
There is no security hole if I am singing my own certificate for my own mails on my own server; it would mean that I do not trust... myself?
Now if I were to provide this as a commercial service, sure, my customers may be worried.
Re: iOS 18 breaks IMAPS self-signed certs
#20Earlier quoted context omitted.
No, but you could use DNS for that internal IP. And then you'd have a hostname. Since your IMAP server likely has some way of getting external mail, it is likely that you have a DNS zone and MX records, so adding an A record for your internal IMAP access isn't that much of an effort compared to what you already would have. If you have mmd45.com as a domain and have MX records pointing to your mail server, adding imap…
unfortunately none of that applies to my setup. my imap server lives in a dmz and doesn't have all that other jazz.
Only thing required for this setup to work: client needs to be able to resolve domain to internal ip.
I have wireguard mesh with a bunch of services that use LE for TLS that have no access to interwebs and not accessible from interwebs.