Affected Version: 1.60 (31)

Is this a Test Flight version or the App Store version? AppStore

Device and iOS Version: iPhone 6s, iOS 11.1.1

What steps will reproduce the problem?

1. self signed local domain
2. CA and cert in iPhones local profiles
3. TLS Inspector will mark certificate as „error“

What is the expected output? Well as I accepted the CA in the installed profile, the domain should be green.

What do you see instead? Certificates and Server marked as error (red x). There is no further info on what is wrong. Details would be helpful (also in case of non-selfsigned CAs/domains)

Please provide any additional information below.

Affected Version:

2.0.3

Is this a Test Flight version or the App Store version?

App Store version

Device and iOS Version:

iPad Air 2, iOS 13.3.1

What steps will reproduce the problem?

1. Create your own certificate authority root signing certificate
2. Use the CA to sign a subject certificate for your own web site
3. Install the CA root certificate as a trusted root CA on iOS (install a profile with the root CA public key, and then mark it as trusted in the certificate trust settings ("enable full trust for root certificates")
4. Install the subject certificate and its chain in your web server
5. connect to the web server with TLS inspector

What is the expected output?

TLS inspector should show the site as trusted, like Safari shows.

What do you see instead?

TLS says the site is not trusted

Please provide any additional information below.

Previous issue #82 claims to have fixed it, but not for me. Possibly something new in iOS 13?

Affected Version:

1.7.0 (37)

Is this a Test Flight version or the App Store version?

TestFlight

Device and iOS Version:

iPhone 7 iOS 11.2.6

What steps will reproduce the problem?

1. Enable CRL Check in the preferences
2. use TLS inspector on an SSL site with an untrusted certificate (e.g. https://untrusted-root.badssl.com or https://pki-demo.idnomic.net, either by entering the host name in the app or within Safari

What is the expected output?

TLS Inspector shows the certificate detail

What do you see instead?

TLS Inspector crashes early (the interface the is sometimes displayed for less than a second, then crashes)

Please provide any additional information below.

disabling the CRL download option fixes the issue for the sites above.

Affected Version: 1.6.0 (31)

Is this a Test Flight version or the App Store version? App Store

Device and iOS Version: iPad Mini 2 - 9.3.3, iPhone 8 - 11.0.3/11.1.1 iPhone 6 - 11.0.3

What steps will reproduce the problem?

1. Create Root CA
2. Create Self Signed Certificate with the root
3. Bind on IIS and install CA on device

What is the expected output? Should show if certificate chain is valid/invalid

What do you see instead? App Crashes

Affected Version:

2.0.2(73)

Is this a Test Flight version or the App Store version?

App Store

Device and iOS Version:

iPhone X - 13.3.1

What steps will reproduce the problem?

1. Enter "burn.net" into app.
2. Observe "connection information".

What is the expected output?

The IP address of burn.net: 2607:f2f8:a4c8::2

What do you see instead?

An IP address from the same prefix, but I have no idea what the specific host bits are corresponding to:

2607:f2f8:a4c8:0:8100:e32b:7d3a:b5a4

Please provide any additional information below.

Screenshot - https://imgur.com/a/pGbdXlS

Affected Version:

1.6.0

Is this a Test Flight version or the App Store version?

App Store

Device and iOS Version:

All

What steps will reproduce the problem?

1. Make a request to a HTTP Server that requires a UserAgent Header
2. Request fails

What is the expected output?

Request should work

What do you see instead?

Request fails, because no user agent was provided

Please provide any additional information below.

A short description of the feature you're requesting:

Add the OCSP Must Staple information to the certificate's information.

How do you imagine this feature looking? Are there any examples of other implementations?

This feature appears in OpenSSL as an entry called "TLS Feature". Because other TLS features may be added, categorize the information in the certificate into one category.

How do you feel this feature will benefit TLS Inspector?

More information is available in the current certificate information.

OpenSSL x509 Information (Example)

Information Using OCSP Must Staple:

...
            X509v3 Subject Alternative Name:
                DNS:blabla.
            TLS Feature:
                status_request
            X509v3 Certificate Policies:
...

Information without OCSP Must Staple:

...
            X509v3 Subject Alternative Name:
                DNS:blabla.
            X509v3 Certificate Policies:
...

I can not speak english very well. Sorry.

Affected Version: Multiple? I believe I have had this problem for some time. Now I run 1.5.3.29.1.1.0e

Is this a Test Flight version or the App Store version? No

Device and iOS Version: iPhone 8 iOS 11 and iPhone 7 iOS 11.

What steps will reproduce the problem?

1. Start Chrome, Brave, Firefox or Opera Mini.
2. Go to a https-enabled site. Eg https://www.google.com
3. Use the Share-function and select Show Certificate.

What is the expected output? Information about the certificate to be displayed.

What do you see instead? An error message in TLS-Inspector says " Unsupported Scheme. Only HTTPS sites can be inspected."

Please provide any additional information below. It works on Safari and Firefox Focus.

I'm trying to troubleshoot an issue with IOS10 and SSL through a custom PAC file.. If a proxy is defined in network settings it would be great for this app to parse and use them ...

When sharing a domain name to "View on SSL Labs" the result of the test will be shared on the dashboard of ssllabs.com (https://www.ssllabs.com/ssltest/index.html). This can be disabled by checking the box "Do not show the results on the boards" on the query website as well as by appending &hideResults=on to the query URL. (e.g. https://www.ssllabs.com/ssltest/analyze.html?d=github.com&hideResults=on)

This option control could possibly be implemented by displaying a summary view of the data which will be sent to ssllabs.com and a switch control after selecting "View on SSL Labs" from the share menu.

This feature would enhance the privacy of a query.

The OpenSSL team has announced the upcoming release 1.1.1g which includes a fix for a high severity vulnerability.

Details regarding the vulnerability are not yet known. It is not known if TLS Inspector is impacted, however we will update as soon as the release is available.

Affected Version:

1.3.0+

Is this a Test Flight version or the App Store version?

Both

Device and iOS Version:

iPad

What steps will reproduce the problem?

1. In Safari, tap share then tap Show Certificate

What is the expected output?

The certificate window to occupy more of the screen

What do you see instead?

It only taking a small portion of the screen

Please provide any additional information below.

A short description of the feature you're requesting:

TLS Inspector is equipped to implement a DoT/DoH client that users could use to skip the systems DNS nameservers.

How do you imagine this feature looking? Are there any examples of other implementations?

Under Advanced Options a new toggle for "Use Custom DNS Server", enabling it revels an input and a radio with "DNS", "DoH", and "DoT".

A pre-getter should be added (may tie into #208) that performs the lookup, and passes the IP Address to connect to + domain name to validate to the getter.

How do you feel this feature will benefit TLS Inspector?

DoT/DoH provide privacy benefits, and DNS resolver can be used as a form of traffic inspection.

Apple's CT policy is now active for certificates issued after October 15th 2018: https://support.apple.com/en-ca/HT205280

TLS Inspector should show a specific warning when a certificate is untrusted because of these policy violations.

This is a feature suggestions not a bug report.

I think it would be very convenient if the app could report not only if a certificate is trusted by the system but if it meets Apple’s new standards for “App Transport Security.”

These standards specify allowed ciphers and other requirements, and apps need to request specific exceptions in order to use HTTPS with hosts that don’t meet those standard.

Why would this be useful? I suspect many of the fans of this app are developers, and it’s a question anyone working on iOS needs to answer about their servers.