Kcfstreamerrordomainssl, -9802 When Connecting to a Server by Ip Address Through Https in iOS 9

How to call https url in uiwebview?

I have explained below how to access https url in UIWebview it will help you clear the problem because it works for me.

Calling http is same as https url.

If, however, you're using a self-signed certificate, it's necessary to add some additional code.Because by default iOS will reject all untrusted https connections.

Restricting untrusted connections is very good default behaviour and any disabling of this is highly risky.So we will show an alert as we're going to bypass the default behaviour.

-(BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace;

-(void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge;

These two above methods allows us to provide our own authentication mechanism for trusted connections

#import "ClassCon.h"
//  For now, I've hard coded the IP address of my trusted server.
#define TRUSTED_HOST @"192.168.1.2"


@implementation ClassCon {
    NSMutableData *contentData;
    NSURLConnection *conn;
}

-(void) loadContent {
    contentData = [NSMutableData data];
    NSString *contentURL = @"our url";
    conn = [[NSURLConnection alloc] initWithRequest:
            [NSURLRequest requestWithURL:[NSURL URLWithString:contentURL]] delegate:self];

}

- (void)connection:(NSURLConnection *)connection didReceiveData:(NSData *)data {
    [contentData appendData:data];
}

- (void)connection:(NSURLConnection *)connection didFailWithError:(NSError *)error {
    NSLog(@"Bad: %@", [error description]);
    ContentResponse *response = [[ContentResponse alloc]initWithRc:-999 andDescr:@"error" andAction:0];


    conn = nil;
}

- (void)connectionDidFinishLoading:(NSURLConnection *)connection {
        NSString *loadedContent = [[NSString alloc] initWithData:
                                     contentData encoding:NSUTF8StringEncoding];
        NSLog(@"Loaded content: %@",loadedContent);

    }

// ------------ ByPass ssl starts ----------
-(BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:
(NSURLProtectionSpace *)protectionSpace {
    return [protectionSpace.authenticationMethod
            isEqualToString:NSURLAuthenticationMethodServerTrust];
}

-(void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:
(NSURLAuthenticationChallenge *)challenge {
    if (([challenge.protectionSpace.authenticationMethod
          isEqualToString:NSURLAuthenticationMethodServerTrust])) {
        if ([challenge.protectionSpace.host isEqualToString:TRUSTED_HOST]) {
            NSLog(@"Allowing bypass...");
            NSURLCredential *credential = [NSURLCredential credentialForTrust:
                                           challenge.protectionSpace.serverTrust];
            [challenge.sender useCredential:credential
                 forAuthenticationChallenge:challenge];
        }
    }
    [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
}
// -------------------ByPass ssl ends




@end

Hope this helps

How to call https url in uiwebview?

I have explained below how to access https url in UIWebview it will help you clear the problem because it works for me.

Calling http is same as https url.

If, however, you're using a self-signed certificate, it's necessary to add some additional code.Because by default iOS will reject all untrusted https connections.

Restricting untrusted connections is very good default behaviour and any disabling of this is highly risky.So we will show an alert as we're going to bypass the default behaviour.

-(BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace;

-(void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge;

These two above methods allows us to provide our own authentication mechanism for trusted connections

#import "ClassCon.h"
//  For now, I've hard coded the IP address of my trusted server.
#define TRUSTED_HOST @"192.168.1.2"


@implementation ClassCon {
    NSMutableData *contentData;
    NSURLConnection *conn;
}

-(void) loadContent {
    contentData = [NSMutableData data];
    NSString *contentURL = @"our url";
    conn = [[NSURLConnection alloc] initWithRequest:
            [NSURLRequest requestWithURL:[NSURL URLWithString:contentURL]] delegate:self];

}

- (void)connection:(NSURLConnection *)connection didReceiveData:(NSData *)data {
    [contentData appendData:data];
}

- (void)connection:(NSURLConnection *)connection didFailWithError:(NSError *)error {
    NSLog(@"Bad: %@", [error description]);
    ContentResponse *response = [[ContentResponse alloc]initWithRc:-999 andDescr:@"error" andAction:0];


    conn = nil;
}

- (void)connectionDidFinishLoading:(NSURLConnection *)connection {
        NSString *loadedContent = [[NSString alloc] initWithData:
                                     contentData encoding:NSUTF8StringEncoding];
        NSLog(@"Loaded content: %@",loadedContent);

    }

// ------------ ByPass ssl starts ----------
-(BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:
(NSURLProtectionSpace *)protectionSpace {
    return [protectionSpace.authenticationMethod
            isEqualToString:NSURLAuthenticationMethodServerTrust];
}

-(void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:
(NSURLAuthenticationChallenge *)challenge {
    if (([challenge.protectionSpace.authenticationMethod
          isEqualToString:NSURLAuthenticationMethodServerTrust])) {
        if ([challenge.protectionSpace.host isEqualToString:TRUSTED_HOST]) {
            NSLog(@"Allowing bypass...");
            NSURLCredential *credential = [NSURLCredential credentialForTrust:
                                           challenge.protectionSpace.serverTrust];
            [challenge.sender useCredential:credential
                 forAuthenticationChallenge:challenge];
        }
    }
    [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
}
// -------------------ByPass ssl ends




@end

Hope this helps

CFNetwork SSLHandshake failed (-9824) against server that support TLSv1.2

* TLS 1.2 connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

This is a DHE cipher suite curl uses here. This might mean that your server does not support ECDHE cipher suites because usually these are preferred compared to DHE.

From the iOS 9 Release Notes:

DHE_RSA cipher suites are now disabled by defaults in Secure Transport for TLS clients. This may cause failure to connect to TLS servers that only support DHE_RSA cipher suites. ...

This means if your server only supports DHE ciphers then the connection will fail in the default setup of an iOS 9 client. This is likely the case here.

Alamofire 4.0.1 SSL Requests Failing (secure connection to the server cannot be made)

To summarize the comments, @OP's site did not meet Apple's iOS ATS requirements. When tested with SSL Labs, the site scored an F and indicated lack of support for TLS. While bypassing ATS could have been an option, the server's TLS configuration was improved using the IIS Crypto tool as described at https://scotthelme.co.uk/getting-an-a-on-the-qualys-ssl-test-windows-edition/

Note: DO NOT set up Strict Transport Security without knowing what it does.

This addressed the issue.

How to connect to self signed servers using Alamofire 1.3

There is a way to change the Server Trust Policy of the Alamofire manager shared instance, but it's not recommended. Instead you should create your own customised instance of the manager. Here is the recommended solution, code is Swift 2.0 with Alamofire from swift-2.0 branch, compiled in Xcode7 beta 5.

Creating customised instance of the manager

Because you will not use the request method on the Alamofire, but use the one on your custom manager instead, you need to think of where to store the manager. What I do is to store it as static in my networking wrapper (the class that utilizes Alamofire and deals with my application networking needs). I set it up like this:

private static var Manager : Alamofire.Manager = {
        // Create the server trust policies
        let serverTrustPolicies: [String: ServerTrustPolicy] = [
            "maskeddomain.com": .DisableEvaluation
        ]
        // Create custom manager
        let configuration = NSURLSessionConfiguration.defaultSessionConfiguration()
        configuration.HTTPAdditionalHeaders = Alamofire.Manager.defaultHTTPHeaders
        let man = Alamofire.Manager(
            configuration: NSURLSessionConfiguration.defaultSessionConfiguration(),
            serverTrustPolicyManager: ServerTrustPolicyManager(policies: serverTrustPolicies)
        )
        return man
    }()

Next step is to switch all your calls that use Alamofire.request() with Manager.request(), so you should have something like this:

Manager.request(.GET, "http://stackoverflow.com").responseJSON(
    completionHandler: { (_, respose, result) -> Void in
            if result.isSuccess {
                // enjoy your success
            } else if result.isFailure {
                // deal with your failure
            }
    })

If you want to change the shared instance of the manager anyway, go here for more info.

---

Related Topics