NSURLErrorClientCertificateRejected when only matching client certificate is expired in WebKit
0 reputation · 17 May 2025, 18:04 UTC
When a TLS server requests a client certificate during mutual authentication, WebKit's NSURLSession presents identities from the Keychain that match the server's trusted CA list. If the only matching certificate has expired, the authentication challenge fails with NSURLErrorClientCertificateRejected (-1205) and no system-provided fallback UI appears to let the user select an alternative valid certificate.
This behavior stems from WebKit's certificate selection logic in AuthenticationCF.cpp, which does not automatically retry the challenge with other Keychain identities. The Keychain enforces least-privilege access through ACLs requiring user consent per identity, yet the embedding application (Safari) does not expose a certificate picker for expired-credential scenarios. Enterprise MDM profiles can pre-provision certificates and modify ACLs, further complicating the fallback decision.
- Should WebKit implement an automatic retry mechanism that filters out expired certificates before presenting the challenge?
- Is a system-level certificate picker the appropriate UI layer for this failure mode, or should the embedding application handle fallback selection?
- How do TLS 1.3 verification changes in recent WebKit versions affect the error code surfacing and challenge flow?
safari