Does anyone know if there is any way to get iOS's mail client to present a client cert? Or, barring that, any form of self-hosted MFA.
iOS 18 breaks IMAPS self-signed certs
21–30 of 157 posts
Re: iOS 18 breaks IMAPS self-signed certs
#22Can you add your own CA cert to your device?
Yes, I have a private CA I install on all my Apple devices for my self-signed certs. After I have the root CA on the device, it looks like any other valid SSL to iOS / macOS.
Nit-pick: In that case the certs aren’t self-signed, they are regular leaf certs, chained to a “non-standard” CA.
Re: iOS 18 breaks IMAPS self-signed certs
#23Earlier quoted context omitted.
No, but you could use DNS for that internal IP. And then you'd have a hostname. Since your IMAP server likely has some way of getting external mail, it is likely that you have a DNS zone and MX records, so adding an A record for your internal IMAP access isn't that much of an effort compared to what you already would have. If you have mmd45.com as a domain and have MX records pointing to your mail server, adding imap…
unfortunately none of that applies to my setup. my imap server lives in a dmz and doesn't have all that other jazz.
This can still work imap.mydomain.com resolving to your hardcoded private ip, put the cert on your imap server, connect by name, done.
Re: iOS 18 breaks IMAPS self-signed certs
#24:-( hey lurking apple devs- can someone please escalate this?
I would not bet money that Apple is willing to change their mind regarding this question.
Re: iOS 18 breaks IMAPS self-signed certs
#25:-( hey lurking apple devs- can someone please escalate this?
I would not bet money that Apple is willing to change their mind regarding this question.
per apple dev forums it seems like they have a history of breaking this and then fixing it. additionally, while IMAP is broken, calendars and notes seem to work just fine so hopefully it's not deliberate.
Re: iOS 18 breaks IMAPS self-signed certs
#26Re: iOS 18 breaks IMAPS self-signed certs
#27I wish they could break Snapchat, Facebook etcs ‘s self-signed certs. I own the device, why can’t I see the traffic to and from all of these apps if I add my self-signed cert and approve to use a MITM-proxy.
Most apps work, but not everyone.
Often called certificate pinning.
Re: iOS 18 breaks IMAPS self-signed certs
#28Earlier quoted context omitted.
unfortunately none of that applies to my setup. my imap server lives in a dmz and doesn't have all that other jazz.
Only thing required for this setup to work: client needs to be able to resolve domain to internal ip. I have wireguard mesh with a bunch of services that use LE for TLS that have no access to interwebs and not accessible from interwebs.
how are you renewing the LE certificate if the domain is resolving to an internal ip? this seems like a big hoop to jump through.
Re: iOS 18 breaks IMAPS self-signed certs
#29Earlier quoted context omitted.
Only thing required for this setup to work: client needs to be able to resolve domain to internal ip. I have wireguard mesh with a bunch of services that use LE for TLS that have no access to interwebs and not accessible from interwebs.
how are you renewing the LE certificate if the domain is resolving to an internal ip? this seems like a big hoop to jump through.
Re: iOS 18 breaks IMAPS self-signed certs
#30I wish they could break Snapchat, Facebook etcs ‘s self-signed certs. I own the device, why can’t I see the traffic to and from all of these apps if I add my self-signed cert and approve to use a MITM-proxy. Most apps work, but not everyone. Often called certificate pinning.
Apple isn't doing certificate pinning, it's the apps verifying the certificate chain themselves by baking in public keys (or hashes/fingerprints). So there's not really a way for Apple to break this.