A very significant portion of our user base is experiencing issues with CA certificates not being trusted anymore after updating to iOS 18. This problem was not present in previous iOS versions.
Most users said to be reproducing the issue just by updating to iOS 18. But it does not always happen, and the pattern is not clear.
We were able to reproduce the issue once, and did some investigation:
Any previously installed and trusted CA certificate, prior to reproducing the issue, stopped working. It looks like they are not trusted anymore:
They are no longer showing in the 'Certificate Trust Settings' screen. Just the 'Trust Store Version' and the 'Trust Asset Version' are showing there.
When trying to check if a certificate is trusted programmatically with SecTrustEvaluateWithError, we get the following error:
Error Code: -67843
Localized Description: "CA Name" certificate is not trusted
NSUnderlyingError: Error Domain=NSOSStatusErrorDomain Code=-67843 "Certificate 0 "CA Name" has errors: Root is not trusted;" UserInfo={NSLocalizedDescription=Certificate 0 "CA Name" has errors: Root is not trusted;}
NSLocalizedDescription: "CA Name" certificate is not trusted
Before reproducing the issue, the CA certificate was showing as trusted in the 'Trust Store Version', and the same piece of code that evaluates if the certificate is trusted (SecTrustEvaluateWithError) was returning that the certificate was trusted.
And although it's possible to install new CA certificates profiles, they never show in the 'Certificate Trust Settings' screen. We tried with several CA certificates, our own and other ones publicly available.
Both cases were reproduced for CA certificates installed:
Through an MDM profile
By opening the CA cert URL in Safari and installing it manually from settings
The only way of fixing the issue was through 'Erase All Content and Settings' option. Several things we attempted without success were:
Erasing all settings (without erasing content/data)
Removing all the profiles and installing them again
Additional notes:
We did an iPhone backup after reproducing the issue. If at this point we 'Erase All Content and Settings', then the issue is gone. But if we restore again from this backup, the issue happens again.
We already filed a bug FB15386539 (CA certificates not being trusted) and attached the sysdiagnose log that was generated after installing the profile.
Thanks.