Using OpenSSL to create an iOS-compatible self-signed certificate with subjectAltName extension for use with NSURLConnection without overriding willSendRequestForAuthenticationChallenge

mkcert.sh

#!/bin/bash

DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )

ORGNAME=mytestorg
HOSTNAME=$(hostname -s)

KEY_LENGTH=4096
DIGEST=sha512
DAYS_VALID=9999

KEY_FILE="${DIR}/${HOSTNAME}.key"
CONF_FILE="${DIR}/${HOSTNAME}.conf"
CSR_FILE="${DIR}/${HOSTNAME}.csr"
CRT_FILE="${DIR}/${HOSTNAME}.crt"

OPENSSL=openssl
if [[ -x /usr/local/opt/openssl/bin/openssl ]]; then
    # Use homebrew openssl
    OPENSSL=/usr/local/opt/openssl/bin/openssl
fi

cat <<EOF > "${CONF_FILE}"
[ req ]
distinguished_name  = req_distinguished_name
req_extensions = v3_req
 
[ req_distinguished_name ]
0.organizationName		= Organization Name (eg, company)

commonName      = Common Name (e.g. server FQDN or YOUR name)
commonName_max      = 64
 
[ v3_req ]
basicConstraints = critical,CA:true,pathlen:1
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyCertSign
subjectAltName = @alt_names
 
[alt_names]
DNS.1 = ${HOSTNAME}.local
DNS.2 = localhost
DNS.3 = ${HOSTNAME}
EOF

$OPENSSL req -new -newkey "rsa:${KEY_LENGTH}" -keyout "${KEY_FILE}" "-${DIGEST}" -config "${CONF_FILE}" -out "${CRT_FILE}" -nodes -subj "/O=${ORGNAME}/CN=${HOSTNAME}" -x509 -extensions v3_req -days "${DAYS_VALID}"

rm "${CONF_FILE}"

$OPENSSL x509 -in "${CRT_FILE}" -text

# Trusting on Mac:
# 1. This command will launch keychain utilities in import mode
# 2. Choose the login keychain
# 3. Double click the newly imported cert
# 4. Expand the trust section
# 5. Choose "Always Trust"
# 6. Close the pop-up dialog
# 7. Should prompt you for your admin password
#
# On an iOS device:
# 1. Email the .crt file to yourself
# 2. Tap in email
# 3. Choose "Install"
# 4. Enter your passcode
# 5. Choose "Install" (should see ROOT CERTIFICATE warning)
# 6. Choose "Install" again
# 7. Should so Verified with green checkmark
#
# On an iOS simulator, same steps but replace steps 1-2 with dragging
# the .crt file into the simulator window. Alternately, you could
# install into the trust stores of all your simulators at once by
# using something like the iostrust rubygem.

open "${CRT_FILE}"