Question: I create a self signed certificate by using this

```
openssl req \
    -newkey rsa:2048 \
    -x509 \
    -nodes \
    -keyout myKey.key \
    -new \
    -out myCert.crt \
    -subj /CN=my.domaine.any \
    -config ./myConfig.cnf \
    -reqexts SAN \
    -extensions SAN \
    -sha256 \
    -days 365

```

the content of myConfig is

```
[ req ]
default_bits        = 2048
distinguished_name  = req_distinguished_name
req_extensions      = SAN
extensions          = SAN
[ req_distinguished_name ]
countryName         = myCountry
stateOrProvinceName = myProvince
localityName        = myCity
organizationName    = myOrgan
[SAN]
subjectAltName      = DNS:my.domaine.any
extendedKeyUsage    = serverAuth

```

I check the IOS certificate requirement that I find here <https://support.apple.com/en-us/HT210176> (I hope, I have everything).

I ame able to install the certificate into Setting > General > Profile.

But I can't trust my certificate because when I'm going to Setting > General > About > Certificate Trust Settings, I didn't see any certificate.

Any clue ?

Answer: 
I found what's was missing into my configuration.

should add in [SAN] part

```
basicConstraints=CA:TRUE,pathlen:0

```

and it work !
Make sure when you send the certificate to your phone you don't also export the private key. Safari won't trust and it won't appear under the `Certificate Trust Settings`.

I'm using Powershell on Windows and was using the command `Export-PFXCertificate` which includes the private key. Instead using the command `Export-Certificate` worked.