I've been trying to get the iOS simulator to play nice with our internal dev servers.
I've installed the root CA by dragging it to the simulator. It's enabled by default but I toggled it on/off anyway just to be sure.
I connected via safari and got the error in the title. Connected via the app (actually XCTest) and got:
2020-03-30 11:45:53.001800+0300 xctest[20258:5222958] [] nw_coretls_callback_handshake_message_block_invoke_3 tls_handshake_continue: [-9812]
2020-03-30 11:45:53.001 xctest[20258:5222959] NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)
2020-03-30 11:45:53.004 xctest[20258:5222951] Error in <file/line>: Optional(Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “<domain>” which could put your confidential information at risk." UserInfo={NSURLErrorFailingURLPeerTrustErrorKey=<SecTrustRef: 0x7fd53fd12480>, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9813, NSErrorPeerCertificateChainKey=(
"<cert(0x7fd546009200) s: <domain> i: <CA>>"
), NSUnderlyingError=0x7fd541a157e0 {Error Domain=kCFErrorDomainCFNetwork Code=-1202 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x7fd53fd12480>, _kCFNetworkCFStreamSSLErrorOriginalValue=-9813, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9813, kCFStreamPropertySSLPeerCertificates=(
"<cert(0x7fd546009200) s: <domain> i: <CA>>"
)}}, NSLocalizedDescription=The certificate for this server is invalid. You might be connecting to a server that is pretending to be “<domain>” which could put your confidential information at risk., NSErrorFailingURLKey=https://<url>, NSErrorFailingURLStringKey=<url>, NSErrorClientCertificateStateKey=0})
I've connected from chrome on Mac and it works fine. I actually copied the CA from the mac's keychain to the simulator.
Went over the checklist from https://support.apple.com/en-us/HT210176:
- key size = 4096
- hash algorithm is SHA-256 RSA
- there's a DNS name in the SAN (but also in CN). It says CN names are not trusted but it doesn't say they're not allowed.
- There's a value in EKU
- It's valid for two years
I've also compared the certificate as presented in Safari iOS to that in Chrome Mac. Looks fine. Finally, I've installed 10.3 on the simulator just to rule out some new bug/restriction.
Running on Catalina/Xcode 11.4
I'd appreciate help in one of the following:
- An actual solution
- Help diagnosing this. A link to more up to date requirements or a tool to see why the cert is failing.