December 31, 2007

iPhone email and self-signed mail server certificates

After obtaining an iphone, one of the first things I wanted to do with it was setup email access. I found that setting it up with gmail access was really easy, so I wanted to set up access to our own rawthought email server.

I initially had some problems where the email setup complained "Secure Connection Failed: The certificate for mail.rawthought.com may be invalid." As Scott Gruby points out, this seems to be due to the fact that our server's certificate is self-signed.

However, I did find a workaround to this problem. After you get this first "Secure Connection Failed" dialog and click Continue, the iPhone email client tries various other ways to connect to your email server. This can take about five minutes, even with a WiFi connection, and a status dialog will read "Verifying IMAP account information". Finallly it will prompt you: "Cannot Connect Using SSL: Do you want to try setting up the account without SSL?"

If you say Yes to this dialog, setup will actually succeed. You might assume that this means that SSL security is permanently turned off for this email account. However, if you look at Settings -> Mail and look at the "Use SSL" toggle under "Incoming Settings", you'll see that SSL is turned ON.

While I haven't used a network analyzer to see exactly what's going on here, it appears that clicking Yes in the "Cannot Connect Using SSL" dialog causes the email client to accept the self-signed certificate. Subsequent mail checks work OK. Posted by todd at December 31, 2007 05:34 PM