Getting specific error when validating certificate, SecTrustEvaluateWithError

Question

MuniekMg OP

Created Jun ’22

Replies 4

Boosts 0

Participants 2

Hi, I'm trying to validate certificate that I know has two problems:

Too long expiration date
Hostname mismatch

I'm ok with those problems so when they occurs I want to accept this certificate as valid.

When using:

success = SecTrustEvaluateWithError(trust, &error)
let dictionary = SecTrustCopyResult(trust)

this dictionary contains validation failure reasons under key "TrustResultDetails"

- key : SSLHostname
- value : 0

- key : ValidityPeriodMaximums
- value : 0

but none of those keys are documented and not really sutable for production code?

My question is how to know validation failure reasons or how to change validation method to pass validation when those problems occurs?

Thanks :)

Answered by DTS Engineer in 718531022

It is coming from IoT device

Ah, I thought that might be the case.

Given that, I’m going to start you out with my TLS For Accessory Developers post. If that doesn’t resolve your issue, post back with a summary of where you got to.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Jun ’22

Is this certificate coming from a server on the wider Internet? Or from a local service, like an accessory?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

MuniekMg OP

Jun ’22

It is coming from IoT device

wrong hostname because we are connecting via IP address, this is not really a problem because we have SAN name
long expiration date is our real problem here, we do not want to generate new certificates every 825 days

0

Answer 3

DTS Engineer OP

Apple

Jun ’22

Accepted Answer

It is coming from IoT device

Ah, I thought that might be the case.

Given that, I’m going to start you out with my TLS For Accessory Developers post. If that doesn’t resolve your issue, post back with a summary of where you got to.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

1

Answer 4

MuniekMg OP

Jun ’22

Thank you :) It works. I didn't know SecPolicyCreateBasicX509 is like "just check the minimum"

0