IOS11: ATS (应用程序传输安全)不再接受定制锚证书？

我使用 NSMutableURLRequest租赁自签名证书，当证书使用 SecTrustSetAnchorCertificates IOS 11的自定义证书锚定时，出现以下错误消息:

refreshPreferences: HangTracerEnabled: 1
refreshPreferences: HangTracerDuration: 500
refreshPreferences: ActivationLoggingEnabled: 0 ActivationLoggingTaskedOffByDA:0
ATS failed system trust
System Trust failed for [1:0x1c417dc40]
TIC SSL Trust Error [1:0x1c417dc40]: 3:0
NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)
Task <721D712D-FDBD-4F52-8C9F-EEEA28104E73>.<1> HTTP load failed (error code: -1200 [3:-9802])
Task <721D712D-FDBD-4F52-8C9F-EEEA28104E73>.<1> finished with error - code: -1200

过去在 IOS 10中起作用的东西现在在 IOS 11中不起作用了。

我知道 IOS 11不再支持以下内容:

  • RC43DES-CBC AES-CBC
  • MD5SHA-1
  • < 2048位 RSA Pub 密钥-所有到服务器的 TLS 连接
  • 网址: http://
  • SSLv3
  • TLS 1.0
  • TLS 1.1

除了一个指纹 SHA-1之外，证书不使用这些指纹，但是也列出了一个 SHA-256指纹。

通过添加以下内容，我们可以绕过 ATS (App Transport Security)错误:

<key>NSAppTransportSecurity</key>
<dict>
<key>NSExceptionDomains</key>
<dict>
<key>mydomain.example</key>
<dict>
<!--Include to allow subdomains-->
<key>NSIncludesSubdomains</key>
<true/>
<key>NSExceptionRequiresForwardSecrecy</key>
<false/>
</dict>
</dict>
</dict>

通过安装根/锚证书到电话本身也工作，而不需要白名单的 mydomain.example。

这是否意味着 ATS 不再支持自签名证书？

以下人员在 IOS 10工作:

SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)certs);

在 Mac 电脑上使用 nscurl会出现很多故障，在将根证书安装到“ System”Keystore 之后，nscurl就成功了。 这是我在 macOS 10.12.6上做的。

nscurl --verbose --ats-diagnostics https://

我如何使用一个自定义证书，但不需要安装证书或白名单的域工作？

11011 次浏览
小开

Some time ago macOS started enforcing a requirement that CA certificates can't also be used as end-entity (eg webserver) certificates. Is it possible that iOS added this requirement between 10 and 11?

If so, the workaround is simple: you create your self-signed CA certificate, and use that certificate to issue the webserver certificate. The CA certificate (basicConstraints: CA=True) is the trust anchor that goes in your trust store; the end-entity certificate (omit basicConstraints; extendedKeyUsage=serverAuth) is presented by the web server. You're just not allowed to use the exact same certificate for both any more.

(This should be a comment but I don't have enough points to comment yet.)


提交答案