Signed CA is missing CN value breaking ability to trust for SSL on iOS devices

[davidalger]

The PEM file generated by Warden during the install process for signing certificates used by Traefik is lacking a CN value thus breaking the ability to install the certificate as a profile and then trust the certificate on iOS devices. Opening the PEM on iOS currently results in an installed profile, but the certificate is not showing up in the list of certificates to be trusted for SSL after installing as a profile.

The following forum thread appears to describe this exact scenario, and indicates the lacking CN value as the culprit: https://forums.developer.apple.com/thread/89568

Information in forum thread should be validated, and the install routine corrected appropriately. As regenerating a CA would require re-signing already present certificates, the regeneration will be left a manual process (cleanup files, run warden install, etc) and I will plan to call this out in release notes once fixed.

Another example of this iOS peculiarity cropping up can be found here: FiloSottile/mkcert#47

The following KB page documents how one is expected to trust a CA for SSL on iOS devices: https://support.apple.com/en-us/HT204477

[davidalger]

For those needing to re-create CA root and re-issue certificates, the following process should be followed:

1. Remove existing trusted certificate

   a) macOS/Darwin

   sudo security remove-trusted-cert -d ~/.warden/ssl/rootca/certs/ca.cert.pem
   

   b) Fedora/CentOS

   sudo rm /etc/pki/ca-trust/source/anchors/warden-proxy-local-ca.cert.pem
   

   c) Ubuntu/Debian

   sudo rm /usr/local/share/ca-certificates/warden-proxy-local-ca.crt
   

2. Cleanup all issued certs and CA root files

   rm -rf ~/.warden/ssl
   

3. Re-create and trust new CA

   warden install
   

4. Re-issue SSL certificates as needed via warden sign-certificates ...

[davidalger]

Following changes in associated PR, the Warden issued CA now shows up for trusting on iOS devices: