SSL Decryption with iOS 13 Devices

[davisjj]

We began testing of the iOS 13 beta last week on several test devices that are connected to our internal mobile device network.  This network passes traffic through the Palo with SSL decryption.  We are finding that iOS 13, even with our cert installed on the device via MDM, does NOT accept the decrypt cert.  We are still testing, but so far we have found several applications that will not work (some give errors, some just don't do anything), Safari will not open HTTPS sites, and our MDM environment cannot send commands to the devices.  In all cases, once we take the device off of the internal WiFi, eliminating SSL decrypt, everything works.

I have not yet been able to find any documentation from Apple indicating that they are enforcing certificate pinning across the OS, but it sure seems like they might be.  Has anyone else encountered this yet?

Thanks

[BPry]

@davisjj,

Just curious why you would starting testing on the initial beta while things are known to be broken and not wait until at least the public preview? This release is so Devs can actually start working with the new APIs, for what you are doing the Public Preview that's due out next month is far more appropriate for your testing. 

If you look at the release notes the MDM queries not returning properly is a known issue and is currently broken within the developer preview. If Apple is enforcing Cert Pinning throughout the OS it certaintly hasn't been documented anywhere and wasn't mentioned at WWDC. 

[davisjj]

Thanks for the reply.  I am well aware of the perils of beta 1.  That's why I have multiple devices.  My company does do internal iOS development, although that's a relatively recent addition. 

That said, I think that IT professionals who support iOS in their environment should begin testing iOS releases as soon as they are available.  It seems that Apple is starting to take this approach as well, seeing as how they are going to allow customers who are enrolled in Apple Business Manager to begin downloading the betas at the same time as developer program members.  In this case, getting an early jump on things has allowed me to open up the conversation internally.  We are asking, "what if" in regards to decrypt.  We have also said we won't make any changes until later in the beta cycle to see if it is still an issue.

I don't have any problem living with a semi-working device for a few months.  I've been doing that annually for years.  My question was regarding whether or not I missed something in the WWDC presentations/docs.  It sounds like I didn't, so we will take a wait and see approach.  Frankly, I'd like to see them push the issue with cert pinning.  I don't think it is necessary to decrypt mobile device traffic.  All that leads to is users turning off their WiFi when things don't work.

[RocRaider]

Did you ever find a resolution to this. We are running in to the same thing on our devices that are running iOS 13. 

[lucianocf]

I'm with the same problem. There is any solution?

[george.v.bowles]

Same problem here. iOS 12.x devices are fine and have been for a long time. All other devices (Windows, Chromebooks, Linux, Android) with install cert are fine. iOS 13.x devices are broken. Cert is installed, trusted. We are stumped. Cannot figure out why this will not work. Had a 2 hour call with Apple on 10/17/2019 and they are having us send some extended logging info to them. Please reply if there is any additional information to share.

[RocRaider]

We are seeing similar issues with macOS Catalina. Certificate is installed but we continue to get SSL errors when using safari. 

[george.v.bowles]

@RocRaider- We are in the same boat on the same page. Frankly, we have no idea what to do. We have 3,000 iPads and fewer than 50 MacBooks and we're not getting much help from either PaloAlto or Apple. I hope somebody figures it out soon because we have, basically, given up. If someone doesn't get this under control soon my Financial Advice would be to invest in Chromebook Manufacturers!

[BPry]

Has anyone verified that you meet the new system requirements for iOS 13 and macOS 10.15? With these in place we haven't run into any issues decrypting Apple traffic, but if you don't meet one of the new requirements then this will cause the device to reject the trusted cert. 

https://support.apple.com/en-us/HT210176

[george.v.bowles]

Yep! First thing we did when they came out and we started having trouble.

[melbatniji]

Hi Bpry,

I am trying to apply the requirements to my Palaolto self-generated certificate but I wonder if you can help me on how to apply/configure the following requirement. Can you share more information on how to apply these requirements on the firewall?

TLS server certificates must contain an ExtendedKeyUsage (EKU) extension containing the id-kp-serverAuth OID.

[Chadi_Sleiman]

Where you able to generate the certificate with these requirement from the firewall? Or did you have to use for instance OpenSSL or generate a CSR and get the proper cert from a CA?

[Chadi_Sleiman]

Have you tried changing the certificate settings on the Mac itself? I changed them to Use System default on my Catalina and it started working. Mind you this was for authentication to global protect but it still may be worth a shot.

[NWesolowski]

I also had this problem on my iPhone (13.5.1) and the Global Protect app.  After successfully establishing a connection to my company network most websites would not load and displayed a certificate error due to SSL decryption.  Here is the resolution:

1. Verify that your certificate profile is showing up under Settings > General > Profile.  You should have been prompted to install this when connecting to GP for the first time.

2. This is the part that I was missing.  Settings > General > About > Certificate Trust Settings (scroll to the bottom).

3. "Enable Full Trust" for your GP root certificate.

Once I did this I could browse to any site without certificate issues.  Good luck!

[Chadi_Sleiman]

So you have to change these settings on the IOS device itself? Were you able to use a self-signed certificate? did you still have to meet the requirements set in this link?

https://support.apple.com/en-us/HT210176

Really appreciate your response, thank you!