HTTPS with NSURLConnection - NSURLErrorServerCertificateUntrusted

Question

I have an application that connects perfectly to http. When I tried https, I received an error saying that the root certificate is not trusted. I found the URLs for my site certificate, its CA certificate and CA root certificate and added them through Safari to the phone. Now, when I go to Preferences → General → Profiles, I can see all my certificates that go through the whole chain. Each certificate has an unsigned red signature. However, when I connect, I get the error NSURLErrorServerCertificateUntrusted. I'm trying to figure out where to go next.

Any help would be great. The only thing that can affect this is that I am connecting to an odd port. So my url is www.domain.com:port. Port number creates certificate - domain name mismatch?

Now I used the iPhone configuration utility to add the configuration profile to the phone. It has my root certificate, ca certificate and site certificate. The profile on the phone confirms its confirmation. In detail, I see my three certificates. But when I try to connect, I still get an untrusted certificate error. Any suggestions?

Just trying to figure out if anyone else can help with this?

Answer 1

There is a supported API for ignoring bad certificates during NSURLConnection loading. To do this, simply add something similar to your NSURLConnection delegate:

- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace { return [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]; } - (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge { if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) if (... user allows connection despite bad certificate ...) [challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge]; [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge]; } 

Note that the connection: didReceiveAuthenticationChallenge: can send its message to the .sender call (much) later, after providing the user with a dialog box, if necessary, etc.