Application Transport Security Management (kCFStreamErrorDomainSSL, -9802)

Question

You run this code:

let URL = "https://www.nasa.gov/sites/default/files/wave_earth_mosaic_3.jpg" let imageData = NSData(contentsOfURL: NSURL(string: URL)!) UIImage(data: imageData!) 

and you will get the following:

2015-09-11 16: 33: 47.433 Cassini [21200: 447896] Error loading NSURLSession / NSURLConnection (kCFStreamErrorDomainSSL, -9802)

Digging a little deeper, the signature SHA1 is used.

 maximveksler$ openssl s_client -connect www.nasa.gov:443 < /dev/null 2>/dev/null | openssl x509 -text -in /dev/stdin | grep "Signature Algorithm" Signature Algorithm: sha1WithRSAEncryption Signature Algorithm: sha1WithRSAEncryption 

So, as of September 11, 2015, NASA is using an insecure connection, now what?

Answer 1

Why did this happen?

Because using an insecure Internet is bad for the privacy of your users.

Starting with iOS9, Apple uses secure connections that the application makes for any resource accessible via HTTP. This means that the server you are connecting to must follow the latest secure connection practices.

As of September 2015, they include:

• Use HTTPS (not plain http)
• Sign the certificate using SHA-2
• Use Forward Secrecy

Further information can be found on the App Transport Security Technote.

What can you do?

Manage your own servers? Fix it! make sure they are durable and reliable. You can make sure your server is good by checking it online with shaaaaaaaaaaaaa.com or locally with any of the outline methods here

If you connect to other servers , there are options for problematic white list resources, this is discouraging.

Reduce the security of a specific URL

Go to Info.plist and add the following entries:

 <key>NSAppTransportSecurity</key> <dict> <key>NSExceptionDomains</key> <dict> <key>www.nasa.gov</key> <dict> <key>NSExceptionAllowsInsecureHTTPLoads</key> <true/> </dict> </dict> </dict> 

Your plist should look like this:

Globally disable application transport security

Notice this is a really bad idea.

Go to Info.plist and add the following entries:

 <key>NSAppTransportSecurity</key> <dict> <key>NSAllowsArbitraryLoads</key> <true/> </dict> 

Your plist should look like this: