Using mTLS for Secure Baby Monitor Connections
summary
Implements mutual TLS for baby monitors by generating per-device keys in Secure Enclave, sending a CSR to the backend which returns a per-camera certificate, and storing both in the keychain so URLSession can present an identity during TLS handshake. Builds identities from keychain entries, handles URLSessionDelegate challenges, and uses certificate pinning for server trust. Works around third-party libs via method swizzling and solves HLS playback by proxying through a local proxy for AVPlayer. Implementation is production-ready after extended iteration.
AI-written summary · about
chapters (11)
- 0:00Introduction and motivation
- 2:35IoT camera security risks
- 7:32Certificate pinning basics
- 10:02Mutual TLS explained
- 11:55Implementing certificate pinning
- 15:52Certificate generation for cameras
- 18:24Secure Enclave and keychain challenges
- 20:55Identity creation and validation
- 22:01Enforcing mTLS in iOS
- 23:50AVPlayer and mTLS workaround
- 25:17Summary and recommendations
related talks
25mHow SSL Pinning Reinforces iOS App Security
17mIntroducing Mutual Tls Authentication for Syslog-Drains
11mPrivacy-Preserving Protocols for Smart Camera Systems and Other IoT Devices
46mSelf-Signed, Why Not! Exploiting Insecure Certificate Validation In iOS And macOS
20mUsing an mTLS Identity Provider to achieve Password-less auth...
19mKeynote: Demystifying Secure Application Communication with Zero Trust: Identity, Integri...
22mmTLS: When Certificate Authentication is Done Wrong
31mHow We Solved TLS at Scale: Self-Service, Multi-Tenant Cert-manager