Archive for June 6, 2019

New TLS security requirements for iOS 13 and macOS Catalina 10.15

June 6, 2019 1 comment

As part of the information published at WWDC 2019 by Apple, the following KBase article has been released:

Requirements for trusted certificates in iOS 13 and macOS 10.15:

Screen Shot 2019 06 05 at 8 39 55 PM

This KBase article describes how Apple is implementing new security requirements for TLS server certificates. These certificates are used by servers to encrypt communication between Apple devices and those servers, to make sure that all communication between the servers and those devices is protected.

  • Certificate key sizes must be 2048-bit or greater
  • SHA-2 must be used for the certificate signing
  • DNS hostname of the server must be listed in a Subject Alternative Name (SAN) certificate extension in addition to being listed in the Common Name field of the certificate.

Also, all TLS certificates issued after July 1, 2019 must meet these additional requirements:

What happens if you use iOS 13 or macOS Catalina to try to connect to servers with TLS certificates which don’t meet these standards? The connection will fail because the OS will reject the certificate as being invalid. This may result in a web browser not connecting, an app crashing or some other undesired behavior.

Screen Shot 2019 06 05 at 8 47 31 PM

Screen Shot 2019 06 05 at 8 48 57 PM

As part of testing iOS 13 and macOS 10.15 ahead of their release dates, I strongly recommend testing the various services used at your workplace to make sure that the TLS certificates used by the services of your company, school or institution are able to pass these requirements. Otherwise, you may find some unfortunate surprises on Release Day this fall.

Categories: iOS, Mac administration, macOS
%d bloggers like this: