title: How do I programmatically import a certificate into my iOS app's keychain and pass the identity to a server when needed?
body: <p>I am working on an iOS5 application that will facilitate mobile payments between two users. As part of the payment process, the sender and the recipient need to communicate with a server. The server requires that both parties present their identities when an authentication challenge is initiated upon connection.</p>
  
  <p>Currently, I have hard-coded the certificate process by utilizing the following two methods in my code:</p>
  
  <p><strong>NSURLConnection Delegate <em>didReceiveAuthenticationChallenge</em></strong></p>
  
  <pre><code>(void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:    (NSURLAuthenticationChallenge *)challenge
  {
  NSLog(@"Authentication challenge");
  
  // Load Certificate
  NSString *path = [[NSBundle mainBundle] pathForResource:@"PKCS12" ofType:@"p12"];
  NSData *p12data = [NSData dataWithContentsOfFile:path];
  CFDataRef inP12data = (__bridge CFDataRef)p12data;
  
  SecIdentityRef myIdentity;
  SecTrustRef myTrust;
  extractIdentityAndTrust(inP12data, &amp;myIdentity, &amp;myTrust);
  
  SecCertificateRef myCertificate;
  SecIdentityCopyCertificate(myIdentity, &amp;myCertificate);
  const void *certs[] = { myCertificate };
  CFArrayRef certsArray = CFArrayCreate(NULL, certs, 1, NULL);
  
  NSURLCredential *credential = [NSURLCredential credentialWithIdentity:myIdentity certificates:(__bridge NSArray*)certsArray persistence:NSURLCredentialPersistencePermanent];
  
  [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
  }
  </code></pre>
  
  <p><strong>C Method <em>extractIdentityAndTrust</em></strong></p>
  
  <pre><code>OSStatus extractIdentityAndTrust(CFDataRef inP12data, SecIdentityRef *identity, SecTrustRef *trust)
  {
  OSStatus securityError = errSecSuccess;
  
  CFStringRef password = CFSTR("password");
  const void *keys[] = { kSecImportExportPassphrase };
  const void *values[] = { password };
  
  CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL);
  
  CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
  securityError = SecPKCS12Import(inP12data, options, &amp;items);
  
  if (securityError == 0) {
      CFDictionaryRef myIdentityAndTrust = CFArrayGetValueAtIndex(items, 0);
      const void *tempIdentity = NULL;
      tempIdentity = CFDictionaryGetValue(myIdentityAndTrust, kSecImportItemIdentity);
      *identity = (SecIdentityRef)tempIdentity;
      const void *tempTrust = NULL;
      tempTrust = CFDictionaryGetValue(myIdentityAndTrust, kSecImportItemTrust);
      *trust = (SecTrustRef)tempTrust;
  }
  
  if (options) {
      CFRelease(options);
  }
  
  return securityError;
  }
  </code></pre>
  
  <p>I have tested this code numerous times and have been successful. Now I am trying to move on and allow the appropriate identity to be stored and then retrieved from the app's keychain. My objective is to allow users to import their P12 files via iTunes File Sharing or Dropbox and save them to the keychain.</p>
  
  <p>I have looked at Apple's documentation for <a href="https://developer.apple.com/library/ios/#documentation/Security/Conceptual/CertKeyTrustProgGuide/iPhone_Tasks/iPhone_Tasks.html#//apple_ref/doc/uid/TP40001358-CH208-DontLinkElementID_10" rel="nofollow noreferrer">Getting and Using Persistent Keychain References</a> and have been unable to figure out how to import the identity. Their code is a little confusing to me as they use undeclared variables/references (specifically the </p>
  
  <pre><code>&amp;persistent_ref
  </code></pre>
  
  <p>variable). If anyone could help decipher it, that would be greatly appreciated.</p>
  
  <p><strong>TL;DR:</strong> How do I save the contents of a P12 file into my iOS5 app's keychain and retrieve it later to hand off to an NSURLConnection didReceiveAuthenticationChallenge method?</p>