How to disable HTTPS checks (ATS), self-signed app and IP address

Question

Created Apr ’17

Replies 1

Boosts 0

Views 5.2k

Participants 1

Hello, I’m learning Obj-C, Xcode 8.3, MacOS 10.12.4, and running into trouble opening HTTPS connection to a local development server. No matter what I do I get the error “the certificate for this server is invalid”. I tried going into the project info.plist and disabling everything in ATS, still no luck.

  <key>NSAppTransportSecurity</key>
  <dict>
  <key>NSAllowsArbitraryLoads</key>
  <true/>
        <key>NSAllowsArbitraryLoadsForMedia</key>
        <true/>
        <key>NSAllowsArbitraryLoadsInWebContent</key>
        <true/>
        <key>NSAllowsLocalNetworking</key>
        <true/>
  </dict>

I found a reference to the “nscurl” binary and every test fails. I’m trying to access the server by IP address as it is an ephemeral resource that comes up in various testing forms on DHCP. I can access the server just fine using `curl —insecure`. I suspect the hostname returned by the servers self-signed certificate is ‘localhost’ and something in the framework just won’t work with it. openssl s_client returns:

depth=0 /C=US/ST=NJ/L=City/O=Company/OU=APP/CN=localhost
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=US/ST=NJ/L=City/O=Company/OU=APP/CN=localhost
verify return:1

From a few tests I’ve done (with nscurl and and otherwise) it looks like the framework will not validate the handshake when using IP addresses. If that is the case that’s bad for me as I really shouldn’t try to trick ‘localhost’ to be some arbitrary IP address.

My testing app will never be in a distributed application and the servers connected to are internal only. I’m looking for how I can go about disabling ATS completely or what else might be done to relax this constraint and allow my code to connect.

Boost

Answer 1

jamesnj OP

Apr ’17

After much searching here and head scratching, I found a (simple enough) answer to move my project along. I was able to browse the IP via safari and, click the trust always, and let it bring the certificate into the key chain. After this at least my example programs can work with https.

However I would prefer not to drag these into my key chain, and still stick to using non-delegate NSURLSession's dataTaskWithRequest:completionHandler:. Is there any way I can simply disable the IP/self-signed server trust evaluation, or perhaps some way I can extract a given certificate using openssl to a file and read that in as needed to satisfy my non-delegate NSURLSession requests?

Thanks,

0