[jordache]

what if device is not connected to internet or that you have the apple certificate check IPs blocked in your corporate proxy?

[saagarjha]

As of iOS 8.1, enterprise-signed apps will refuse to launch if the device has not recently checked in with Apple to grab the latest revocation list.

[shinymark]

Got it, that was the main missing link that I was looking for. Devices are frequently phoning home to get an updated certificate revocation list.

[jordache]

how easy is it ti mock this list? Say you map that apple endpoint within your local network to mocked revocation list? I assume it's probably hashed?

[saagarjha]

It’s probably signed by Apple or something like that.