Reverse engineer the SAS security challenge

[hufman]

I've run into difficulties trying to use iOS Connected Apps certs, the car rejects the Android-provided security response. I have the feeling that this challenge and response is tied into a cert (perhaps some RSA4096 signature), but which cert and what data is combined with the challenge to provide the response? Figuring this out would unlock use of the plentiful iOS Connected Apps certs.