FireBase 错误 -9806，SSL 错误 -1200

Question

我正在使用 2016 年 I/O 引入的新 FireBase SDK，在与我的应用集成后出现此错误。这发生在应用启动时。

2016-08-06 06:28:06.237 MyApp[49084:2511094] CFNetwork SSLHandshake failed (-9806)
2016-08-06 06:28:06.238 MyApp[49084:2511094] NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9806)
2016-08-06 06:28:06.453 MyApp[49084:2511094] CFNetwork SSLHandshake failed (-9806)
2016-08-06 06:28:06.454 MyApp[49084:2511094] NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9806)

2016-08-06 06:28:06.854 MyApp[49084:2510825] <Firebase/Network/ERROR> Encounter network error. Error: Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, NSUnderlyingError=0x7bf93200 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, _kCFNetworkCFStreamSSLErrorOriginalValue=-9806, _kCFStreamErrorCodeKey=-9806, _kCFStreamErrorDomainKey=3, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x7bc97840>, kCFStreamPropertySSLPeerCertificates=<CFArray 0x7bcf2420 [0x477d1f8]>{type = immutable, count = 3, values = (
0 : <cert(0x7bc96990) s: *.googleapis.com i: Google Internet Authority G2>
1 : <cert(0x7bc96fb0) s: Google Internet Authority G2 i: GeoTrust Global CA>
2 : <cert(0x7bc97360) s: GeoTrust Global CA i: Equifax Secure Certificate Authority>)}}}, _kCFStreamErrorCodeKey=-9806, NSErrorFailingURLStringKey=https://play.googleapis.com/log, NSErrorPeerCertificateChainKey=<CFArray 0x7bcf2420 [0x477d1f8]>{type = immutable, count = 3, values = (
0 : <cert(0x7bc96990) s: *.googleapis.com i: Google Internet Authority G2>
1 : <cert(0x7bc96fb0) s: Google Internet Authority G2 i: GeoTrust Global CA>
2 : <cert(0x7bc97360) s: GeoTrust Global CA i: Equifax Secure Certificate Authority>)}, NSErrorClientCertificateStateKey=0, NSURLErrorFailingURLPeerTrustErrorKey=<SecTrustRef: 0x7bc97840>, NSErrorFailingURLKey=https://play.googleapis.com/log}

2016-08-06 06:28:06.856 MyApp[49084:] <FIRAnalytics/ERROR> Encounter network error. Error: Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, NSUnderlyingError=0x7b968c00 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, _kCFNetworkCFStreamSSLErrorOriginalValue=-9806, _kCFStreamErrorCodeKey=-9806, _kCFStreamErrorDomainKey=3, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x7b9abbb0>, kCFStreamPropertySSLPeerCertificates=<CFArray 0x7b8a2420 [0x477d1f8]>{type = immutable, count = 3, values = (
    0 : <cert(0x7b9aaf40) s: *.google-analytics.com i: Google Internet Authority G2>
    1 : <cert(0x7b9ab280) s: Google Internet Authority G2 i: GeoTrust Global CA>
    2 : <cert(0x7b9ab630) s: GeoTrust Global CA i: Equifax Secure Certificate Authority>
)}}}, _kCFStreamErrorCodeKey=-9806, NSErrorFailingURLStringKey=https://app-measurement.com/config/app/1:926356559846:ios:74ac6682756d2bd6?app_instance_id=7590DD8CDAF44A3ABE3F39478A9EB2BE&platform=ios&gmp_version=3201, NSErrorPeerCertificateChainKey=<CFArray 0x7b8a2420 [0x477d1f8]>{type = immutable, count = 3, values = (
    0 : <cert(0x7b9aaf40) s: *.google-analytics.com i: Google Internet Authority G2>
    1 : <cert(0x7b9ab280) s: Google Internet Authority G2 i: GeoTrust Global CA>
    2 : <cert(0x7b9ab630) s: GeoTrust Global CA i: Equifax Secure Certificate Authority>
)}, NSErrorClientCertificateStateKey=0, NSURLErrorFailingURLPeerTrustErrorKey=<SecTrustRef: 0x7b9abbb0>, NSErrorFailingURLKey=https://app-measurement.com/config/app/1:926356559846:ios:74ac6682756d2bd6?app_instance_id=7590DD8CDAF44A3ABE3F39478A9EB2BE&platform=ios&gmp_version=3201}

Answer 1

这是由 iOS 9+ 上的 App Transport Security 引起的。 Apple 强加restrictions on SSL certificates 并非所有服务器都能满足要求。

如果您拥有生成此消息的服务器，我建议您更新到更安全、更现代的 SSL 服务器证书。但由于它是 Google/Firebase 的服务器，我们所能做的就是专门为此域禁用 App Transport Security。

这是列出域的部分：

NSErrorFailingURLStringKey=https://app-measurement.com...

您需要将此域添加到您的 Info.plist 文件中，如下所示：

<key>NSExceptionDomains</key>
<dict>
    <!-- Firebase/Google Analytics server - Disables App Transport Security for this specific domain -->
    <key>app-measurement.com</key>
    <dict>
        <key>NSExceptionAllowsInsecureHTTPLoads</key>
        <true/>
    </dict>
</dict>

请记住，允许来自第三方服务器的不安全连接可能会给您的应用带来安全漏洞。但是，如果您不向 Google Analytics（分析）服务器发送任何敏感数据（无论如何都不应该这样做），那么风险应该是最小的。

根据Apple's ATS documentation，包括任何 ATS 异常都会在您下次提交到 App Store 时触发审核，因此您可能也需要考虑这一点。

Answer 2

问题出在网络上。有时网络状况太慢导致网络超时，无法按时进行 SSL 检查。这在需要更好安全性的 iOS 9.x 上也经常发生。什么样的 iOS 版本以及您在哪个设备上运行它？是不是一开始就一直这样？

Answer 3

使用正确的签名证书检查捆绑标识符。可能会有所帮助。