title: iOS Client Certificates and Mobile Device Management
body: <p>Our customers want to use an MDM (mobile device management) solution (MobileIron) to install client certificates onto corporate iOS devices, in order to limit access to certain corporate web services to corporate devices only.</p>
  
  <p>MobileIron installs the client certificate into <em>Settings > General > Profiles</em>, which is the default location for certificates in iOS, and Safari can respond with this certificate when a corporate web service challenges it for one.</p>
  
  <p>But I need the same thing to happen from within a custom app. When our app gets challenged for a certificate, I need to be able to respond with the certificate from <em>Settings > General > Profiles</em>. I have examples of responding with a certificate which is bundled with our app, and with a certificate which our app stores within its own keychain, but I <em>do not</em> have an example of responding with a certificate installed on the device in <em>Settings > General > Profiles</em>.</p>
  
  <p>Can anyone explain to me more about what the <code>NSURLAuthenticationChallengeSender</code> protocol method <code>-performDefaultHandlingForAuthenticationChallenge:</code> does? Does <em>default handling</em> mean that iOS effectively responds to the challenge on behalf of the app? Can this response include a client certificate stored in <em>Settings > General > Profiles</em>?</p>
  
  <p><strong>Update</strong></p>
  
  <p>If the MDM could install a client certificate into the app keychain, that would be perfect.</p>