Use built-in network security features for Apple devices
Apple devices feature built-in network security technologies that authorise users and help protect their data during transmission. Apple device network security support includes:
Built-in Cisco IPsec, IKEv2, L2TP
SSL VPN via App Store apps (iOS and iPadOS)
SSL VPN via third-party VPN clients (macOS)
Transport Layer Security (TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3) and DTLS
SSL/TLS with X.509 certificates
WPA/WPA2/WPA3 Enterprise with 802.1X
Shared-secret and Kerberos authentication
RSA SecurID, CRYPTOCard (macOS)
VPN and IPsec
Many enterprise environments have some form of virtual private network (VPN). These VPN services typically require minimal setup and configuration to work with Apple devices, which integrate with many commonly used VPN technologies.
iOS, iPadOS and macOS support IPsec protocols and authentication methods. For more information, see VPN overview.
The SSL 3 cryptographic protocol and the RC4 symmetric cipher suite were deprecated in iOS 10 and macOS 10.12. By default, TLS clients or servers implemented with Secure Transport APIs don’t have RC4 cipher suites enabled. For this reason, they’re unable to connect when RC4 is the only cipher suite available. To be more secure, services or apps that require RC4 should be upgraded to enable cipher suites.
Additional security enhancements include:
Required signing of SMB connections (macOS)
In macOS 10.12 or later, support for AES as an encryption method for Kerberised NFS (macOS)
Transport Layer Security (TLS 1.2, TLS 1.3)
TLS 1.2 supports both AES 128 and SHA-2.
SSL 3 (iOS and iPadOS)
Safari, Calendar, Mail and other internet apps use these to enable an encrypted communication channel between iOS, iPadOS and macOS and corporate services.
You can also set the minimum and maximum TLS version for your 802.1X network payload with EAP-TLS, EAP-TTLS, PEAP and EAP-FAST. For example, you can set:
Both to same specific TLS version
The TLS minimum version to a lower value and the TLS maximum version to a higher value, which would then be negotiated with the RADIUS server
A value of none, which would allow the 802.1X supplicant to negotiate the TLS version with the RADIUS server
iOS, iPadOS and macOS require the server’s leaf certificate to be signed using the SHA-2 family of signature algorithms, and use either an RSA key of at least 2,048 bits or an ECC key of at least 256 bits.
iOS 11, iPadOS 13.1 and macOS 10.13, or later, add support for TLS 1.2 in 802.1X authentication. Authentication servers that support TLS 1.2 may require the following updates for compatibility:
Cisco: ISE 2.3.0
FreeRADIUS: Update to version 2.2.10 and 3.0.16.
Aruba ClearPass: Update to version 6.6.x.
ArubaOS: Update to version 18.104.22.168.
Microsoft: Windows Server 2012 - Network Policy Server.
Microsoft: Windows Server 2016 - Network Policy Server.
For more information on 802.1X, see Connect Apple devices to 802.1X networks.
All Apple platforms support industry-standard Wi-Fi authentication and encryption protocols, to provide authenticated access and confidentiality when connecting to the following secure wireless networks:
WPA3 Enterprise 192-bit security
To view a list of 802.1X wireless authentication protocols, see 802.1X configurations for Mac.
FaceTime and iMessage encryption
iOS, iPadOS and macOS create a unique ID for each FaceTime and iMessage user, helping to ensure that communications are encrypted, routed and connected properly.