iOS 13 TLS issue

objective-c xcode tls1.2 ios13
Dragisa Dragisic picture Dragisa Dragisic · Sep 19, 2019 · Viewed 18.2k times · Source

I have installed iOS 13 beta version and run my framework which contains a lot of network requests, but I got this error:

2019-09-19 15:01:33.566811+0200 ---[395:25439] Connection 4: default TLS Trust evaluation failed(-9814)
2019-09-19 15:01:33.567022+0200 ---[395:25439] Connection 4: TLS Trust encountered error 3:-9814
2019-09-19 15:01:33.567110+0200 ---[395:25439] Connection 4: encountered error(3:-9814)
2019-09-19 15:01:33.569824+0200 ---[395:25439] Connection 4: unable to determine interface type without an established connection
2019-09-19 15:01:33.584952+0200 ---[395:25439] Task <D97FD611-0B48-4DCE-99C9-6A971E5E6524>.<4> HTTP load failed, 0/0 bytes (error code: -1202 [3:-9814])

I tried to find out what cause that problem with no success. Can anyone help me?

Answer

Matteo Pacini picture Matteo Pacini · Sep 19, 2019

Apple has defined stricter rules for TLS server certificates, starting from iOS 13 and macOS 10.15.

All TLS server certificates must comply with these new security requirements in iOS 13 and macOS 10.15:

TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits. Certificates using RSA key sizes smaller than 2048 bits are no longer trusted for TLS.

TLS server certificates and issuing CAs must use a hash algorithm from the SHA-2 family in the signature algorithm. SHA-1 signed certificates are no longer trusted for TLS.

TLS server certificates must present the DNS name of the server in the Subject Alternative Name extension of the certificate. DNS names in the CommonName of a certificate are no longer trusted.

Additionally, all TLS server certificates issued after July 1, 2019 (as indicated in the NotBefore field of the certificate) must follow these guidelines:

TLS server certificates must contain an ExtendedKeyUsage (EKU) extension containing the id-kp-serverAuth OID.

TLS server certificates must have a validity period of 825 days or fewer (as expressed in the NotBefore and NotAfter fields of the certificate).

And the final note:

Connections to TLS servers violating these new requirements will fail and may cause network failures, apps to fail, and websites to not load in Safari in iOS 13 and macOS 10.15.

Related questions

Apple Mach-O Linker Error when compiling for device

I've just upgraded to xcode 4.0 and I can no longer deploy to iPhone, I get a Apple Mach-O Linker Error, it still works for the simulator though. Ld /Users/yveswheeler/Library/Developer/Xcode/DerivedData/iParcel-fkeqjcjcbbhjwhdssjptkdxzzzxh/Build/Intermediates/iParcel.build/Debug-iphoneos/…

Read More
Xcode build failure "Undefined symbols for architecture x86_64"

An Xcode beginner's question: It is my first experience with Xcode 4.6.3. I am trying to write a very simple console program, that searches for paired BT devices and prints them to an NSLog. It builds with the following error: Undefined …

Read More
How can I disable ARC for a single file in a project?

I am using ARC successfully in my project. However, I have encountered a few files (e.g., in unit tests and mock objects) where the rules of ARC are a little more fragile right now. I recall hearing that there …

Read More