Need ATS Help on Intranet Server

I ran TLSTool on my Mac to the server and the results are below.

It seems that your server hit met the most obvious ATS requirements:

• TLS 1.2

• a cypher suite that supports forward secrecy (

  ECDHE_RSA_WITH_AES_256_CBC_SHA384

  )

• a left certificate with suitable key (

  rsaEncryption 2048

  )

• a left certificate signed by a suitable hash algorithm (

  sha256-with-rsa-signature

  )

Is it because I want to use a self-signed option? It makes no sense to pay a cert company $50+ to issue a certificate for a intranet server that they can't even access to verify.

To be clear, I strongly recommend against using a self-signed certificate. I understand the reasons why you don’t want to get a certificate issued by a trusted CA, but that’s not your only alternative. If you’re working in an enterprise environment, your enterprise should run a CA (it probably already does so), install its root certificate on your client devices, and then use that CA to issue a certificate for your server.

If you’re running a really small enterprise, and one that doesn’t already have its own CA, it’s easy to run one using a Mac. Technote 2326 Creating Certificates for TLS Testing has the details. That’s what I do for my home (-:

Having said that, ATS is quite compatible with self-signed certificates. You have two general strategies:

• Install the self-signed certificate on the device itself. If the certificate is set up correctly, the system will trust the certificate for your server and that gets you past that ATS check.

• Disable the ATS ‘server certificate must to be trusted’ requirement using the

  NSExceptionAllowsInsecureHTTPLoads

  property key. Then allow the connection via NSURLSession’s authentication challenge mechanism.

WARNING If you do the latter you must do correct HTTPS server trust evaluation, lest you undo all the security benefits of switching to HTTPS. Technote 2232 HTTPS Server Trust Evaluation explains how to do this.

Share and Enjoy
—
Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thank you for your informative reply!

What I am trying to do is use OpenSSL on Windows to generate my own CA and make certificates based off of that. I have made root PEM and KEY files and for IIS made PEM and KEY files that I used OpenSSL to combine to a PFX file. I put the PFX file in the IIS certificates and used the same PFX in the iOS Simulator. Settings in the simulator show a verified certificate with the right IP address under Profile so it looks like the certificate installed properly. I do also have the NSExceptionAllowsInsecureHTTPLoads key in my info.plist under NSAppTransportSecurity as a Boolean with the value set to YES.

I still get the error NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)

Is there anywhere to look up what that error code even means? I appreciate Apple is trying to improve security for iOS users, it is very important, but I am beyond frustrated with the lack of clarity.

… and used the same PFX in the iOS Simulator.

This makes no sense. A PFX file is the same as a

.p12

If you want the device to trust certificate’s issued by your CA’s root certificate, you should install that root certificate on your device. In OpenSSL terms, encode the root certificate as DER, then put it in a

.cer

Share and Enjoy
—
Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"