95 lines
3.2 KiB
Markdown
95 lines
3.2 KiB
Markdown
# iPhone Enrollment Guide
|
|
|
|
Two steps: first install the CA as a trusted root, then install your personal client cert.
|
|
Both must be done before Safari can reach the EMS.
|
|
|
|
---
|
|
|
|
## Step 1 — Install the CA cert (trust anchor)
|
|
|
|
Do this once. It makes your iPhone trust the EMS server cert and accept the client cert.
|
|
|
|
### On your Mac / Linux machine (in the `infra/ca/` directory):
|
|
|
|
```bash
|
|
# Serve ca.crt temporarily on the LAN
|
|
python3 -m http.server 8080
|
|
```
|
|
|
|
### On the iPhone (Safari — not Chrome):
|
|
|
|
1. Open **Safari** and navigate to `http://192.168.x.x:8080/ca.crt`
|
|
(replace with your Mac's LAN IP — check with `ifconfig | grep 192.168`)
|
|
2. Safari shows: *"This website is trying to download a configuration profile. Do you want to allow this?"* → **Allow**
|
|
3. Open **Settings** → you will see a banner: **Profile Downloaded** → tap it → **Install**
|
|
4. Enter your iPhone passcode if prompted → **Install** (top right) → **Install** again to confirm
|
|
5. Go to **Settings → General → About → Certificate Trust Settings**
|
|
6. Under *"Enable Full Trust For Root Certificates"*, toggle **EMS Private CA** → **Continue**
|
|
|
|
The CA is now trusted. You can stop the Python server.
|
|
|
|
---
|
|
|
|
## Step 2 — Install the client cert
|
|
|
|
Do this once per device. Generate the cert first if you haven't:
|
|
|
|
```bash
|
|
cd infra/ca
|
|
./issue-client-cert.sh lutz-iphone
|
|
```
|
|
|
|
Then transfer `lutz-iphone.p12` to the iPhone. The easiest ways:
|
|
|
|
**AirDrop (recommended):**
|
|
1. On Mac: right-click `lutz-iphone.p12` → Share → AirDrop → select your iPhone
|
|
2. On iPhone: tap Accept
|
|
3. Tap the received file → **Settings** opens automatically
|
|
4. **Settings → Profile Downloaded** → **Install** → enter PKCS12 password → **Install**
|
|
|
|
**Alternatively via Files / Mail / Notes:**
|
|
- Share the `.p12` file to yourself via any app, then tap it to trigger profile installation.
|
|
|
|
---
|
|
|
|
## Step 3 — Test
|
|
|
|
1. Open **Safari** on the iPhone
|
|
2. Navigate to `https://ems.famfi.dyndns.org:9443`
|
|
3. Safari will prompt: *"ems.famfi.dyndns.org" wants to use "lutz-iphone EMS"* → **Continue**
|
|
4. The EMS login page should appear — no certificate warning
|
|
|
|
---
|
|
|
|
## Revoking a device
|
|
|
|
There is no CRL/OCSP for this private CA (not needed for a home setup).
|
|
To revoke a device:
|
|
1. On the iPhone: **Settings → General → VPN & Device Management** → select the EMS profile → **Remove**
|
|
2. Generate a new CA (`gen-ca.sh`) and re-enroll all remaining devices, OR
|
|
regenerate only the server cert and client certs — a revoked client cert is still technically valid
|
|
until the Traefik config is updated to exclude it by CN.
|
|
|
|
For a home setup with 1-2 devices, deleting the profile from the device is sufficient protection.
|
|
|
|
---
|
|
|
|
## Cert renewal (annually)
|
|
|
|
Server and client certs are valid for 825 days (~2.25 years). When they approach expiry:
|
|
|
|
```bash
|
|
cd infra/ca
|
|
./gen-server-cert.sh # new server cert
|
|
scp server.crt server.key user@synology:/etc/ems/certs/
|
|
ssh user@synology "cd /opt/ems && docker compose restart traefik"
|
|
|
|
./issue-client-cert.sh lutz-iphone # new client cert — repeat enrollment Step 2
|
|
```
|
|
|
|
The CA itself is valid for 10 years. Its expiry date:
|
|
|
|
```bash
|
|
openssl x509 -noout -dates -in infra/ca/ca.crt
|
|
```
|