SSL failure when using NSURLSession

Question

Created Nov ’21

Replies 1

Boosts 0

Views 1.6k

Participants 2

For our network application we are trying to connect to different servers located in different places. We are using the following code,

let urlString = //url string

let url = URL.init(string: urlString)

session = URLSession(configuration: .default, delegate: myDelegate, delegateQueue: nil)

var request = URLRequest.init(url: url) //request configuration goes here,

And finally calling this api,

let task = session?.dataTask(with: request) { (data, response, error) {} task.resume()

We are trying to fetch server certificate and using that certificate we are trying to connect to the server but out of 6 servers 1 server certificate is getting this following SSL error

(Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, NSErrorPeerCertificateChainKey=( "<cert(0x103150000) s: /URL/ i: DigiCert SHA2 Secure Server CA>", "<cert(0x103150a00) s: DigiCert SHA2 Secure Server CA i: DigiCert Global Root CA>" ), NSErrorClientCertificateStateKey=0, NSErrorFailingURLKey=/URL/, NSErrorFailingURLStringKey=/URL/, NSUnderlyingError=0x281c387b0 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x282267a20>, _kCFNetworkCFStreamSSLErrorOriginalValue=-9802, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9802, kCFStreamPropertySSLPeerCertificates=( "<cert(0x103150000) s: /URL/ i: DigiCert SHA2 Secure Server CA>", "<cert(0x103150a00) s: DigiCert SHA2 Secure Server CA i: DigiCert Global Root CA>" )}

We are wondering what might have gone wrong. Can someone please help me with this.

Boost

Answer 1

Systems Engineer OP

Apple

Nov ’21

We are wondering what might have gone wrong. Can someone please help me with this.

It looks like you have a chain of trust issue, or a certificate validity issue, with the leaf certificate here:

NSErrorPeerCertificateChainKey=( "<cert(0x103150000) s: /URL/ i: DigiCert SHA2 Secure Server CA>", "<cert(0x103150a00) s: DigiCert SHA2 Secure Server CA i: DigiCert Global Root CA>" ), NSErrorClientCertificateStateKey=0, NSErrorFailingURLKey=/URL/, NSErrorFailingURLStringKey=/URL/,

I would take a look at the properties of the leaf certificate identified here:

NSErrorFailingURLKey=/URL/, NSErrorFailingURLStringKey=/URL/

I suspect that the DigiCert certs are good, but the leaf probably has a setting that is causing an issue. Checkout these references to cross-check this certificate:

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0