Subject: Re: Expiring iPhone Device Sub-CA 

From: "Andrew R. Whalley" <arw@apple.com> 

Received(Date): Mon, 29 Apr 2013 17:28:07 -0700 

Cc: Paul Chinn <pchinn@apple.com>, Dallas De Atley 

<deatley@apple.com>,John Noll <noll@apple.com>, Scott Boyd 

<scott_boyd@apple.com>,Curt Spann <cspann@apple.com>, Jay Towslee 

<jtowslee@apple.com>,Conrad Sauerwald <conrads@apple.com> 

To: Gigi Choy <gigi@apple.com> 

Attachment: smime.p7s 

Date: Mon, 29 Apr 2013 17:28:07 -0700 

Hello,

I sat down with Paul and we discussed the activation certificates. On device, they appear only to 

be used in so far as they are sent up to a server based service for processing - however we didn't 

chase down all code paths.

For some reason I had it in my head that we were just thinking about activation certs. However 

there's of course much more hanging off the iPhone CA. e.g.:

• Device Certificate

• Activation Certificate

• Software Update Certificate

• Development Update Certificate

• OS Application Signing Certificate

• iPhone OS Provisioning Profile Signing Certificate

Am I missing any?

Going though and working out how those are all used locally and what the implications of the 

intermediate expiring is a fair amount of engineering time. Is the desire to understand what could 

be done for Innsbruck to mitigate any issues, or what needs to be done server side before the 

expiry date? Note of course that we've got lots of products in the field that are no longer being 

updated, and Innsbruck will leave a few more behind as well.

Andrew

On Apr 24, 2013, at 3:36 PM, Gigi Choy <gigi@apple.com> wrote:

Hi Paul, 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005804

Case 5:17-cv-00551-LHK Document 285-35 Filed 10/18/18 Page 1 of 3
Just wanted to check-in on this again and make sure it hasn't fallen off the radar. Thanks!

Best Regards, 

---------------------------------------------------------------

 Gigi Choy

PKI Services | gigi@apple.com

On Apr 18, 2013, at 5:55 PM, Paul Chinn <pchinn@apple.com> wrote:

Gigi, I'm out tomorrow and Conrad returns next week but at that time I'll work with Andrew 

and folk to figure out how what's going to happen.

thanks,

Paul

On Apr 16, 2013, at 4:46 PM, Paul Chinn <pchinn@apple.com> wrote:

Looping in Jay and Conrad who I believe have been discussing this.

On Apr 16, 2013, at 4:44 PM, Gigi Choy <gigi@apple.com> wrote:

Hello, 

I just wanted to check in on this topic again as there has not been any discussions for a few 

weeks now. We are now less than one year away from the expiration of the iPhone Device SubCA expiration. One of the main concerns is that if the certificate is checked not only at 

activation, but also upon run time, there is a possibility that iPhone related services could break 

when the CA expires. 

So we need to find out the following: 

1. What services rely on certificates from the iPhone Device Sub-CA? 

2. For these relying services, what certificate validation checks are performed?

3. If the Sub-CA expiration is checked, will services fail open or fail closed? If services will 

fail closed, are there any validation code changes that can be made to prevent services 

from failing? 

What can we do to begin gathering answers to these questions? 

Best Regards, 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005805

Case 5:17-cv-00551-LHK Document 285-35 Filed 10/18/18 Page 2 of 3
---------------------------------------------------------------

 Gigi Choy

PKI Services | gigi@apple.com

On Feb 22, 2013, at 12:32 PM, Dallas De Atley <deatley@apple.com> wrote:

We use that CA to issue the device identities at activation time, I believe. We should double 

check on the trust policies that enforce how those identities are used.

We should make sure that we have a transition plan implemented for Innsbruck:

<rdar://problem/13275668> Ensure that Innsbruck can survive the expiration of the iPhone 

Device Sub CA on April 16th, 2014

Dallas

On Feb 22, 2013, at 11:09 AM, Matthew Murphy <matthew.murphy@apple.com> wrote:

Hi Dallas,

I met with the PKI Services team this morning. There was some question about the "iPhone 

Device Sub-CA", which expires in just over a year (on April 16, 2014).

We're unsure what the impact of this expiration might be, and want to ascertain whether there 

might be any breakage. 

Do you know what the uses of this hierarchy are, or where I could find out more about the 

potential risks?

Thanks,

Matt

Sent from my iPhone

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005806

Case 5:17-cv-00551-LHK Document 285-35 Filed 10/18/18 Page 3 of 3