NSURLConnection HTTP 加载失败（kCFStreamErrorDomainSSL，-9813）[重复]

Question

当我使用http://domain.com 时，我的应用程序运行良好。但是今天，当我将http:// 更改为https:// 时，我遇到了这个问题：NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)。我还对.plist 进行了更改。这是我的.plist 代码：

<key>NSAppTransportSecurity</key>
    <dict>
        <key>NSAllowsArbitraryLoads</key>
        <true/>
        <key>NSExceptionDomains</key>
        <dict>
            <key>dev.domainName.in</key>
            <dict>
                <key>NSExceptionAllowsInsecureHTTPLoads</key>
                <true/>
                <key>NSIncludesSubdomains</key>
                <true/>
                <key>NSTemporaryExceptionMinimumTLSVersion</key>
                <string>TLSv1.2</string>
            </dict>
        </dict>
    </dict>

但我仍然面临这个问题。请帮帮我。我错过了什么？

Answer 1

从 iOS 9 开始，Apple 已强制执行 ATS。 Here 是相关的文档。尝试放松限制，看看它是否有效。

它是否适用于运行 iOS 9 之前的操作系统版本的设备？

Answer 2

根据您的 cmets，您收到无效证书错误并且您正在使用 NSURLConnection，您的解决方案是实现这些委托。看看这是否能解决问题。

- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge { [challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge]; }

请注意，您实际上忽略了 SSL 错误并允许连接继续进行。因此，如果您要打开应用程序进行黑客攻击。对于测试，您可以使用它，但请确保在生产环境中安装正确的证书。

但是，如果您想正确处理此问题并在证书不正确的情况下警告用户，您可以这样做。

OSStatus err = noErr;
BOOL trusted = NO;
NSURLProtectionSpace *  protectionSpace = challenge.protectionSpace;
SecTrustRef serverTrustRef = protectionSpace.serverTrust;
SecTrustResultType trustResult;

//check if the server trust that we got from the server can be trusted by default
err = SecTrustEvaluate(serverTrustRef, &trustResult);
trusted = (err == noErr) && ((trustResult == kSecTrustResultProceed) || (trustResult == kSecTrustResultUnspecified));

if (trusted) //if the site is trusted then continue with that trust
{
    [challenge.sender useCredential:[NSURLCredential credentialForTrust:protectionSpace.serverTrust]
          forAuthenticationChallenge:challenge];
}
else //if not then warn the user about this and let the user make a decision
{
    //warn the user about the cert problem using a dialog with options to continue or ignore.
   //Continue alert action call : [challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust]
          forAuthenticationChallenge:challenge];
   //Dont continue action: [challenge.sender continueWithoutCredentialForAuthenticationChallenge:_challenge]; 
   //OR call: [sender cancelAuthenticationChallenge:challenge];
}

}