21

I installed Xcode 7 and tried running my app under iOS 9. I'm getting the infamous error: Connection failed! Error - -1200 An SSL error has occurred and a secure connection to the server cannot be made. The thing is my server DOES support TLSv1.2 and I'm using NSURLSession.

What could be the problem then?

Improve this question

5 Answers 5

Reset to default
32

Apple has released the full requirements list for the App Transport Security.

Turned out that we were working with TLS v1.2 but were missing some of the other requirements.

Here's the full check list:

  1. TLS requires at least version 1.2.
  2. Connection ciphers are limited to those that provide forward secrecy (see below for the list of ciphers.)
  3. The service requires a certificate using at least a SHA256 fingerprint with either a 2048 bit or greater RSA key, or a 256bit or greater Elliptic-Curve (ECC) key.
  4. Invalid certificates result in a hard failure and no connection.

The accepted ciphers are:

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
Improve this answer
Sign up to request clarification or add additional context in comments.

10 Comments

How do we check those items? The Apple Technote does not tell much more: developer.apple.com/library/prerelease/ios/technotes/…
To Test go to SSL Labs and put in your server url. It will test your certs and grade your setup.
You can include another set of ciphers as I had to because paypal doesn't support those ones, stackoverflow.com/questions/32869268/…
We solved it by renewing our ssl certificate to use SHA2 and enabling TLS v1.2
How about internal testing when you want to connect the app to a server on the internal network?
|
12

In iOS9, Apple added new feature called App Transport Security(ATS).

ATS enforces best practices during network calls, including the use of HTTPS.

Apple Pre-release documentation:

ATS prevents accidental disclosure, provides secure default behavior, and is easy to adopt. You should adopt ATS as soon as possible, regardless of whether you’re creating a new app or updating an existing one.

If you’re developing a new app, you should use HTTPS exclusively. If you have an existing app, you should use HTTPS as much as you can right now, and create a plan for migrating the rest of your app as soon as possible.

Add Below key in your info.plist & then see.

<key>NSAppTransportSecurity</key> <dict> <key>NSAllowsArbitraryLoads</key> <true/> </dict>

Even you can add specific exception, 

<key>NSAppTransportSecurity</key> <dict> <key>NSExceptionDomains</key> <dict> <key>testdomain.com</key> <dict> <key>NSIncludesSubdomains</key> <false/> <key>NSExceptionAllowInsecureHTTPSLoads</key> <false/> <key>NSExceptionRequiresForwardSecrecy</key> <true/> <key>NSExceptionMinimumTLSVersion</key> <string>TLSv1.2</string> <key>NSThirdPartyExceptionAllowInsecureHTTPSLoads</key> <false/> <key>NSThirdPartyExceptionRequiresForwardSecrecy</key> <true/> <key>NSThirdPartyExceptionMinimumTLSVersion</key> <string>TLSv1.2</string> <key>NSRequiresCertificateTransparency</key> <false/> </dict> ... </dict> </dict>
Improve this answer

6 Comments

My server is using TLSv1.2 and I'm using NSUrlSession - so it should work for me automatically no? I don't want to disable TLS in my app.
The other thing possible is certificate on server might not be signed by an authorized CA
I just noticed everywhere in the plist the value 1.2 is set for the minimum version. Isn't that the new default version anyway?
May be.. Have you checked your server side certificate thing?
Is adding the NSAllowsArbitraryLoads-key the way to go for internal testing with a local server (by IP and no SSL)?
|
5

Check out this doc that apple provided.

I had a similar issue at runtime on iOS 9 and what I did to fix it was added the NSAppTransportSecurity Dictionary to my info.plist file with the NSAllowsArbitraryLoads Bool set to true and after cleaning and rebuilding it worked.

I hope this helps!

Improve this answer

7 Comments

My server is using TLSv1.2 and I'm using NSUrlSession - so it should work for me automatically no? I don't want to disable TLS in my app.
May be as temp solution
I think this is some sort of workaround to be honest, there's no way I can ship with this configuration so I'm waiting to see if any new documentation comes out. If any of you use Charles Proxy they have an article about this, and I know a bunch of folks have written about this workaround as well.
What you did is disabled the new ssl check alltogether. Not recommended.
@aroth Little to no warning? WWDC was months ago. Its not hard to configure your SSL properly.
|
3

For me proxy was blocking try to use internet from different source will resolve issue. Wifi, Lan, etc.

Improve this answer

2 Comments

Was not expecting that. But fixed my problem. Thanks.
Damn I woke up to this problem on our production app failing. Started sweating. Read this, turned off wifi, used mobile data and worked... ufff. much better now... thank you.
0

With iOS9, I had a same issue: while SSLlab result showed no issues with protocols / ciphers on my server, a connection to one specific URL failed on an iPad running iOS/9.3.5 with an SSL-Error:

Connection cannot be established.

My stupid mistake was, that I had a redirect, i.e. in NGINX (and similar in Apache):

rewrite /calendar $scheme://www.example.org/resources/calendar;

If the user accessed /calender by setting:

https://example.org/calendar

the server redirected to another domain breaking the establishment of the SSL-connection.

Setting the redirect as follows fixed it:

rewrite /calendar $scheme://$server_name/resources/calendar;
Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.