title: iOS client fails server verification / authentication with f5 BigIP only when server requires client certificate
body: <p>I am running into a strange error in my iOS client when attempting to connect to an f5 BigIP server via 2-way SSL (HTTPS) - the client is able to verify the server via its certificate only when the server is not requiring a client certificate during the SSL negotiation. The certificate for the Root CA that signed the server and my client certificates is already in my trusted anchor certs list.</p>
  
  <p>Here are the steps in each test that I have attempted, and their SSL negotiation outcomes:</p>
  
  <ol>
  <li>Server does NOT require client cert, client verifies server cert (1-way ssl: client -> server)
  <ul>
  <li>Client verifies server certificate (pass)</li>
  <li>Client provides its cert to server (unchecked - not required by server)</li>
  <li>Connection established, server allows client access</li>
  </ul></li>
  <li>Server requires client cert, client verifies server cert (2-way SSL: client &lt;-> server)
  <ul>
  <li>Client verifies server cert (FAIL!!)</li>
  <li>Nothing else happens</li>
  </ul></li>
  <li>Server requires client cert, client accepts any server as trusted (1-way SSL: client &lt;- server)
  <ul>
  <li>Client does NOT verify server cert (<code>setAllowsAnyHTTPSCertificate:YES</code> - done for testing purposes only)</li>
  <li>Client provides its cert to server (pass)</li>
  <li>Connection established, server allows client access</li>
  </ul></li>
  </ol>
  
  <p>Between cases 1 and 2, only the server is changed to require client certs (thereby enabling 2-way SSL), while the client verifies the server cert in both cases.  Between cases 2 and 3, the client is changed to accept all server certs while the server requires a client certificate in both cases.</p>
  
  <p>So it appears that I am only able to achieve 1-way SSL in either direction but not 2-way SSL. This is strange because as the initial step where the client verifies the server should happen before the server asks for a client certificate, and therefore produce the same result each time. The error I get from test case 2 is as follows:</p>
  
  <blockquote>
    <p>The certificate for this server is invalid. You might be connecting to
    a server that is pretending to be “server.myexample.com” which could
    put your confidential information at risk. Error occurred while
    fetching <a href="https://server.myexample.com/service" rel="nofollow">https://server.myexample.com/service</a>: Error
    Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is
    invalid. You might be connecting to a server that is pretending to be
    “server.myexample.com” which could put your confidential information
    at risk.</p>
  </blockquote>
  
  <p>I get additional messages with the same info but specifying the errors: <code>NSErrorFailingURLStringKey</code>, <code>NSErrorFailingURLKey</code>, <code>NSUnderlyingError</code>, and <code>NSURLErrorFailingURLPeerTrustErrorKey</code>.</p>
  
  <p>I don't believe I need a different server certificate for 2-way vs 1-way SSL, or do I?</p>
  
  <p>Thanks in advance!</p>