We are implementing a connection between iPad and iPhone devices using LocalPushConnectivity,
and have introduced SimplePushProvider into the project.
We will have it switch between roles of Server and Client within a single project.
※ iPad will be Server and the iPhone will be Client.
Communication between Server and Client is via TLS, with Server reading p12 file and Client setting public key.
Currently, a TLS error code of "-9836" (invalid protocol version) is occurring when communicating from Client's SimplePushProvider to Server.
I believe that Client is sending TLS1.3, and Server is set to accept TLS1.2 to 1.3.
Therefore, I believe that the actual error is not due to TLS protocol version, but is an error that is related to security policy or TLS communication setting.
Example:
P12 file does not meet some requirement
NWProtocolTLS.Options setting is insufficient
etc...
I'm not sure what the problem is, so please help.
For reference, I will attach you implementation of TLS communication settings.
P12 file is self-signed and was created by exporting it from Keychain Access.
Test environment:
iPad (OS: 16.6)
iPhone (OS: 18.3.2)
ConnectionOptions: TLS communication settings
public enum ConnectionOptions {
public enum TCP {
public static var options: NWProtocolTCP.Options {
let options = NWProtocolTCP.Options()
options.noDelay = true
options.enableFastOpen
return options
}
}
public enum TLS {
public enum Error: Swift.Error {
case invalidP12
case unableToExtractIdentity
case unknown
}
public class Server {
public let p12: URL
public let passphrase: String
public init(p12 url: URL, passphrase: String) {
self.p12 = url
self.passphrase = passphrase
}
public var options: NWProtocolTLS.Options? {
guard let data = try? Data(contentsOf: p12) else {
return nil
}
let pkcs12Options = [kSecImportExportPassphrase: passphrase]
var importItems: CFArray?
let status = SecPKCS12Import(data as CFData, pkcs12Options as CFDictionary, &importItems)
guard status == errSecSuccess,
let items = importItems as? [[String: Any]],
let importItemIdentity = items.first?[kSecImportItemIdentity as String],
let identity = sec_identity_create(importItemIdentity as! SecIdentity)
else {
return nil
}
let options = NWProtocolTLS.Options()
sec_protocol_options_set_min_tls_protocol_version(options.securityProtocolOptions, .TLSv12)
sec_protocol_options_set_max_tls_protocol_version(options.securityProtocolOptions, .TLSv13)
sec_protocol_options_set_local_identity(options.securityProtocolOptions, identity)
sec_protocol_options_append_tls_ciphersuite(options.securityProtocolOptions, tls_ciphersuite_t.RSA_WITH_AES_128_GCM_SHA256)
return options
}
}
public class Client {
public let publicKeyHash: String
private let dispatchQueue = DispatchQueue(label: "ConnectionParameters.TLS.Client.dispatchQueue")
public init(publicKeyHash: String) {
self.publicKeyHash = publicKeyHash
}
// Attempt to verify the pinned certificate.
public var options: NWProtocolTLS.Options {
let options = NWProtocolTLS.Options()
sec_protocol_options_set_min_tls_protocol_version(options.securityProtocolOptions, .TLSv12)
sec_protocol_options_set_max_tls_protocol_version(options.securityProtocolOptions, .TLSv13)
sec_protocol_options_set_verify_block(
options.securityProtocolOptions,
verifyClosure,
dispatchQueue
)
return options
}
private func verifyClosure(
secProtocolMetadata: sec_protocol_metadata_t,
secTrust: sec_trust_t,
secProtocolVerifyComplete: @escaping sec_protocol_verify_complete_t
) {
let trust = sec_trust_copy_ref(secTrust).takeRetainedValue()
guard let serverPublicKeyData = publicKey(from: trust) else {
secProtocolVerifyComplete(false)
return
}
let keyHash = cryptoKitSHA256(data: serverPublicKeyData)
guard keyHash == publicKeyHash else {
// Presented certificate doesn't match.
secProtocolVerifyComplete(false)
return
}
// Presented certificate matches the pinned cert.
secProtocolVerifyComplete(true)
}
private func cryptoKitSHA256(data: Data) -> String {
let rsa2048Asn1Header: [UInt8] = [
0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00
]
let data = Data(rsa2048Asn1Header) + data
let hash = SHA256.hash(data: data)
return Data(hash).base64EncodedString()
}
private func publicKey(from trust: SecTrust) -> Data? {
guard let certificateChain = SecTrustCopyCertificateChain(trust) as? [SecCertificate],
let serverCertificate = certificateChain.first else {
return nil
}
let publicKey = SecCertificateCopyKey(serverCertificate)
return SecKeyCopyExternalRepresentation(publicKey!, nil)! as Data
}
}
}
}