iPhone Enrollment Guide

Two steps: first install the CA as a trusted root, then install your personal client cert. Both must be done before Safari can reach the EMS.

Step 1 — Install the CA cert (trust anchor)

Do this once. It makes your iPhone trust the EMS server cert and accept the client cert.

On your Mac / Linux machine (in the `infra/ca/` directory):

# Serve ca.crt temporarily on the LAN
python3 -m http.server 8080

On the iPhone (Safari — not Chrome):

Open Safari and navigate to http://192.168.x.x:8080/ca.crt (replace with your Mac's LAN IP — check with ifconfig | grep 192.168)
Safari shows: "This website is trying to download a configuration profile. Do you want to allow this?" → Allow
Open Settings → you will see a banner: Profile Downloaded → tap it → Install
Enter your iPhone passcode if prompted → Install (top right) → Install again to confirm
Go to Settings → General → About → Certificate Trust Settings
Under "Enable Full Trust For Root Certificates", toggle EMS Private CA → Continue

The CA is now trusted. You can stop the Python server.

Step 2 — Install the client cert

Do this once per device. Generate the cert first if you haven't:

cd infra/ca
./issue-client-cert.sh lutz-iphone

Then transfer lutz-iphone.p12 to the iPhone. The easiest ways:

AirDrop (recommended):

On Mac: right-click lutz-iphone.p12 → Share → AirDrop → select your iPhone
On iPhone: tap Accept
Tap the received file → Settings opens automatically
Settings → Profile Downloaded → Install → enter PKCS12 password → Install

Alternatively via Files / Mail / Notes:

Share the .p12 file to yourself via any app, then tap it to trigger profile installation.

Step 3 — Test

Open Safari on the iPhone
Navigate to https://ems.famfi.dyndns.org:9443
Safari will prompt: "ems.famfi.dyndns.org" wants to use "lutz-iphone EMS" → Continue
The EMS login page should appear — no certificate warning

Revoking a device

There is no CRL/OCSP for this private CA (not needed for a home setup). To revoke a device:

On the iPhone: Settings → General → VPN & Device Management → select the EMS profile → Remove
Generate a new CA (gen-ca.sh) and re-enroll all remaining devices, OR regenerate only the server cert and client certs — a revoked client cert is still technically valid until the Traefik config is updated to exclude it by CN.

For a home setup with 1-2 devices, deleting the profile from the device is sufficient protection.

Cert renewal (annually)

Server and client certs are valid for 825 days (~2.25 years). When they approach expiry:

cd infra/ca
./gen-server-cert.sh                    # new server cert
scp server.crt server.key user@synology:/etc/ems/certs/
ssh user@synology "cd /opt/ems && docker compose restart traefik"

./issue-client-cert.sh lutz-iphone      # new client cert — repeat enrollment Step 2

The CA itself is valid for 10 years. Its expiry date:

openssl x509 -noout -dates -in infra/ca/ca.crt

3.2 KiB Raw Blame History