topic When https inspection is on: Unable to connect to Apple ID server in Cloud Security

When https inspection is on: Unable to connect to Apple ID server

keithsauer507 — Sat, 09 Mar 2019 01:42:00 GMT

In our testing when HTTP inspection is turned on, iTunes will not allow us to log into an iTunes account in order to perform a backup of an IOS device (iPad / iPhone). The error message is Unable to connect to Apple ID server.

Does anyone know the category used for Apple products where in Decryption policies I can change it from Monitor to Pass Through? Quite possibly it doesn't like the MITM certificate, even though its trusted from our domain CA.

We had to do this for Finance, Government and Law, Online Meetings (for webex), and a custom category for Microsoft and Adobe updates.

Re: When https inspection is on: Unable to connect to Apple ID server

Marvin Rhoads — Wed, 10 Jan 2018 17:51:03 GMT

iTunes uses certificate pinning and is thus (as you surmised) resistant to MiTM decryption, even from authorized appliances.

You need to create a custom rule for iTunes to exempt its traffic from decryption.

Re: When https inspection is on: Unable to connect to Apple ID server

keithsauer507 — Mon, 15 Jan 2018 21:14:31 GMT

Would you suggest to do an ARIN lookup on apple and just throw their owned IP's into a particular group, then apply that group to HTTPS Decryption and change it to pass-through?

Not sure if anyone out there already has one of these rules in place, and what is the most efficient way to detect its apple itunes.

Re: When https inspection is on: Unable to connect to Apple ID server

Marvin Rhoads — Wed, 17 Jan 2018 09:46:26 GMT

The ARIN lookup scheme is something I have seen used successfully in a similar case. That was for ISE with BYOD where the end user needs a pre-auth ACL to allow access to the Google Play store to download the provisioning client.