NEAppProxyProvider VPN and self signed certificates

I’m not going to answer your specific questions, but instead focus on best practices. Apple generally recommends that you configure your VPN server to use a CA-issued certificate that’s trusted by default. This avoids the need for any extra customisation, and enables additional security checks, most notably certificate transparency.

If you’re deploying to an enterprise environment, it’s reasonable to set up an enterprise CA, have it issue a certificate for your server, and then install the enterprise CA’s root certificate on your device via MDM.

We specifically recommend against:

• Self-signed certificates (except insofar as your enterprise CA’s root certificate is self-signed)

• Customising TLS server trust evaluation

If push comes to shove it’s possible to use these techniques, but it’s generally best to stick to the best practices discussed above.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thanks Quinn as always.

So one more question about the usage and observation of "SecTrustSetAnchorCertificates()" API, one thing which we observed is that if we add the lead certificate of the server certification keychain to the "SecTrustSetAnchorCertificates()" and then run "SecTrustEvaluate()" it always "passes" irrespective of the cert being not self-signed with resultType set to "kSecTrustResultUnspecified".

Is this expected behavior? Or "kSecTrustResultUnspecified " indicates some mistrust in this case? As we would expect it to fail as there is no true Anchor certificate added to the list and also there is no CA installed on the device in this case being third party CA.

In the Console logs for "trustd" at one point I see :

completed:  i: >, <cert(0x10100f000) s:="" <issuer=""> i: > > details: (
        {
    },
        {
        AnchorTrusted = 0;
    }
) result: 5

which makes sense but suddenly the result is overriden and set to :

completed:  i: > > details: (
        {
    }
) result: 4

Thanks.