NSURLErrorClientCertificateRejected when only matching client certificate is expired in WebKit

Direct Answer

When a TLS server requests a client certificate for mutual authentication and the only identity matching the server's trusted Certificate Authorities in the Keychain has expired, WebKit's NSURLSession presents that credential and the handshake fails with NSURLErrorClientCertificateRejected (-1205). No system‑level certificate picker appears because the Security framework treats the expired match as a validation failure rather than an ambiguous selection requiring user input.

Likely Explanation

• Certificate matching: WebKit selects the first identity that matches the server's requested CAs; the logic does not pre‑filter expired certificates.
• TLS 1.3 impact: The streamlined handshake eliminates renegotiation steps, so failures surface immediately without a recovery window.
• Keychain ACL constraints: Enterprise MDM profiles may restrict which certificates the app can see, making an expired credential the only visible option.

Confirmed Facts

The error code -1205 is returned by the Security framework when a client certificate is presented but fails server validation, typically due to expiration. The standard delegate method URLSession:didReceiveChallenge:completionHandler: is the only portable way to intercept and re‑issue the challenge.

Required Steps for This Case

1. Intercept the challenge: Implement the NSURLSessionDelegate method and catch NSURLAuthenticationMethodClientCertificate.
2. Query available identities: Use SecIdentityCopyCertificate / Keychain APIs to enumerate identities matching the server's CA list.
3. Filter by validity: Check each SecCertificate's notAfter date against the current time; exclude expired credentials.
4. Handle selection: If a valid identity exists, select it programmatically; if multiple valid identities exist, present a custom UI for the user. If none are available, fail the challenge with a descriptive error.
5. Complete the handshake: Build a URLCredential from the selected identity and pass it to the completion handler.

Diagnostic Detail Needed

Are you observing this behavior in a custom WKWebView / NSURLSession implementation or within the standalone Safari browser? The answer determines whether Safari's internal handling applies or whether you must supply the delegate logic yourself.