Enabling Mutual SSL Authentication

Mutual SSL authentication or certificate based mutual authentication refers to two parties authenticating each other through verifying the provided digital certificate, so that both parties are assured of the others' identity.

After initializing the SMPClientConnection class, use the setClientIdentityCertificate method to set the client certificate.

Examples

Mutual SSL code: –

[SMPUserManagersetDelegate:self];
l_clientconn = [SMPClientConnectioninitializeWithAppID:applicationIddomain:@"default"secConfiguration:odp_cert_sc];
        
    userManager = [SMPUserManagerinitializeWithConnection:l_clientconn];
    
    NSError *error = nil;
    
    SecIdentityRef identityApp = nil;
    
    NSString *path = [[NSBundlemainBundle] pathForResource:@"Certificate"ofType:@"p12"];        /// This is your client certificate
    NSLog(@"path is %@",path);
    NSData *PKCS12Data = [[NSData alloc]initWithContentsOfFile:path];
    
    CFDataRef inPKCS12Data = (__bridge CFDataRef)PKCS12Data;
    CFStringRef password = CFSTR("mobile");
    /// Password of p12 certificate
    const void *key[] = { kSecImportExportPassphrase };//kSecImportExportPassphrase };
    const void *values[] = { password };
    CFDictionaryRef options = CFDictionaryCreate(NULL, key, values, 1, NULL, NULL);
    CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
    OSStatus securityError = SecPKCS12Import(inPKCS12Data, options, &items);
    CFRelease(options);
    CFRelease(password);
    if (securityError == errSecSuccess)
    {
        NSLog(@"Success opening p12 certificate. Items: %ld", CFArrayGetCount(items));
        CFDictionaryRef identityDict = CFArrayGetValueAtIndex(items, 0);
        identityApp = (SecIdentityRef)CFDictionaryGetValue(identityDict, kSecImportItemIdentity);
    } else
    {
        NSLog(@"Error opening Certificate.");
    }
    

    [l_clientconnsetClientIdentityCertificate:identityApp];
    
     //During onboarding with Single and Mutual SSL, add fully qualified domain name of the SMP server instead of just providing
     //IP address. For example vmw5541.wdf.sap.corp or vwxxx.dhcp.wdf.sap.corp.
     [l_clientconnsetConnectionProfileWithHost:@"vmw5541.wdf.sap.corp"port:@"8002"farm:nilrelayServerUrlTemplate:nilenableHTTP:NO];
    
    [userManagerregisterUser:GWUsernameCertpassword:GWPasswordCerterror:&error isSyncFlag:NO];