iOS 9 App Transport Security

Assistance de TMDB

Assistance → Assistance de l'API

posté par Dov Frankel
STAFFMOD
le 31 août 2015 à 18h21

I'm working on an app that will launch on iOS 9, and in order to talk to the TMDb API, I need to disable App Transport Security (a new security feature). It looks (from the headers CURL returns) that your servers support TLSv1.2, correct? That's the main requirement that's catching people. I'm connecting over https, and this is the error I get back:

Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSURLErrorFailingURLPeerTrustErrorKey=<SecTrustRef: 0x7fe438442330>, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9802, NSErrorPeerCertificateChainKey=<CFArray 0x7fe43a406250 [0x10c1447b0]>{type = immutable, count = 3, values = (
    0 : <cert(0x7fe438436890) s: *.themoviedb.org i: RapidSSL CA>
    1 : <cert(0x7fe4384364b0) s: RapidSSL CA i: GeoTrust Global CA>
    2 : <cert(0x7fe438441870) s: GeoTrust Global CA i: Equifax Secure Certificate Authority>
)}, NSUnderlyingError=0x7fe43a2026b0 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x7fe438442330>, _kCFNetworkCFStreamSSLErrorOriginalValue=-9802, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9802, kCFStreamPropertySSLPeerCertificates=<CFArray 0x7fe43a406250 [0x10c1447b0]>{type = immutable, count = 3, values = (
    0 : <cert(0x7fe438436890) s: *.themoviedb.org i: RapidSSL CA>
    1 : <cert(0x7fe4384364b0) s: RapidSSL CA i: GeoTrust Global CA>
    2 : <cert(0x7fe438441870) s: GeoTrust Global CA i: Equifax Secure Certificate Authority>
)}}}, NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., NSErrorFailingURLKey=https://api.themoviedb.org/3/person/287?api_key=9e***********************9faa, NSErrorFailingURLStringKey=https://api.themoviedb.org/3/person/287?api_key=9e*************************9faa, NSErrorClientCertificateStateKey=0}

Any ideas what is wrong? Has a certificate expired or something?

11 réponses (sur la page 1 sur 1)

• Jump to last post

Réponse de Travis Bell

STAFFMOD

le 1 septembre 2015 à 10h03

Hi dovfrankel,

I've heard about this, it was discussed a here. I don't think it's TLS 1.2 (we do support this) but rather the signing of the certificate. Ours was signed using SHA-1 where I believe Chrome and now the new transport in iOS wants it to be SHA-2.

We do have plans to re-sign/renew our certificates but haven't yet. I am not sure on an exact timeline.

Réponse de Dov Frankel

STAFFMOD

le 1 septembre 2015 à 10h08

Oh okay, thanks for the prompt reply. It would be awesome if you could re-sign before iOS 9 goes public, as it may break any apps that haven't been updated. As for myself, I'll temporarily be exempting your domain from App Transport Security. If anyone else is looking into how to do this, add this to your app's plist:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>themoviedb.org</key>
        <dict>
            <key>NSIncludesSubdomains</key>
            <true/>
            <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
            <true/>
        </dict>
    </dict>
</dict>

Réponse de Travis Bell

STAFFMOD

le 1 septembre 2015 à 10h17

Yes, that was going to be my next suggestion. Exempting our domain should work too 😉

We will get to it.

Thanks.

Réponse de AlexNorway

STAFFMOD

le 14 septembre 2015 à 21h01

Any update on this issue as iOS 9 goes public today?

Réponse de Travis Bell

STAFFMOD

le 16 septembre 2015 à 16h46

Hi Alex,

No updates right now, re-signing our SSL certificates hasn't been something that is very high on our priority list. As per Apple's own technote, adding the domain as an exemption is the only way to get around it in iOS 9 for now.

Cheers.

Réponse de AlexNorway

STAFFMOD

le 16 septembre 2015 à 18h15

Yeah, i know how to whitelist and have already done it... but as long as you sign the cert using SHA-2 before Apple one day decides to turn off the whitelist option then Im happy! Thanks for the quick answer.

Réponse de tmdb40840574

STAFFMOD

le 31 mars 2016 à 09h17

Hi all, I'm working on a iOS app and it's the first time I try to connect to API via HTTPS. This is the error I get back:

NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802) Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, NSUnderlyingError=0x7bb6ad20 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, _kCFNetworkCFStreamSSLErrorOriginalValue=-9802, _kCFStreamErrorCodeKey=-9802, _kCFStreamErrorDomainKey=3, kCFStreamPropertySSLPeerTrust=, …

I've resolved with the domain exception, as suggested by the useful Dov's post.

I'm just asking if someone know others solution. I'm working with Swift 2 and Xcode 7.3.

Tks, Alessio.

Réponse de AlexNorway

STAFFMOD

le 31 mars 2016 à 10h51

Alessio, there is no other way until he has time to re-sign their SSL certificates. Whitelisting (domain exception) is the only way.

Réponse de tmdb40840574

STAFFMOD

le 31 mars 2016 à 10h56

Hi Alex, ok, it's clear.

Thank you for your rapid answer.

Alessio.

Réponse de Travis Bell

STAFFMOD

le 16 juin 2016 à 22h51

P.S. We rolled out SHA2 SSL last night, the domain exception shouldn't be necessary anymore.

Réponse de tmdb40840574

STAFFMOD

le 17 juin 2016 à 03h18

I've just tried with Xcode Simulator (no real iPhone) and it seems to be working.

Thank you, Alessio.

Membres de cette conversation

Catégories

Assistance de TMDB