I'm currently developing an iOS app connecting to a REST API. To secure the access of my API, I use on my server (NGINX) an authentication based on the ssl-client-authentication.

I use a .p12 certificate, and to process the authentication I use the swift code described on the accepted answer in this link (Getting client certificate to work for mutual authentication using Swift 3 and Alamofire 4).

Which mean that actually the certificate is store in my projet as resource in the Bundle. So I have several questions about security in iOS and I need advices.

• Is it ok to use a certificate as resource ?

If it is secure to store a certificate as resource.

• What is the best way to store the passphrase for my certificate used in swift code (Xcode Environment Variable, ...) ?

More, I would like to update the certificate when it will be expired by OTA. How this is possible ?

Thank you in advance.