HTTPS request in iOS 9 : NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)

Question

I'm updating my app to accommodate Apple's new ATS. Without any changes to the Plist-Info,the following code throws an error at sendSynchronousRequest() in a vanilla `iOS 9 simulator.

NSURL *url  =[NSURL URLWithString:@"https://Google.com"];
NSMutableURLRequest *request = [[NSMutableURLRequest alloc]init];
[request setHTTPMethod:@"GET"];
[request setURL:url];

NSURLResponse *urlResponse = nil;
NSError *error = nil;    
NSData *reponse = [NSURLConnection sendSynchronousRequest:request
                                        returningResponse:&urlResponse
                                                    error:&error];

Error:

NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)

Any thoughts as to what might be behind this issue?

Ps: I understand that NSURLConnection is deprecated. But this invocations works find if I add AllowArbitraryLoads in Plist.

Look in the Apple Forums, in Networking. I posted on this and got a good answer, as have others. — David H, Jul 27 '15 at 20:35
This is the link: https://forums.developer.apple.com/thread/6452 — David H, Jul 28 '15 at 00:13
Thanks for this link! Only "big hammer" approach mentioned in the forums worked for me :-) Maybe that's because I am using IP address instead of domain name for connecting. — Alexey, Sep 18 '15 at 02:31

score 14 · Accepted Answer · edited Nov 13 '17 at 14:09

14

NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802) corresponds to the server not supporting "Forward Secrecy".

To work around this, add a domain exception to .plist file as follows:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>test.testdomain.com</key>
        <dict>
            <key>NSIncludesSubdomains</key>
            <true/>
            <key>NSTemporaryExceptionRequiresForwardSecrecy</key>
            <false/>
        </dict>
    </dict>
</dict>

edited Nov 13 '17 at 14:09

kalpesh

1,285
1
17
30

answered Jul 31 '15 at 19:20

Vignesh Murugesan

747
1
5
20

1

After add above code in plist.. i'm getting same error NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802) error=Optional(Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." – Yalamandarao Aug 18 '16 at 17:16
i am still facing the issue , have you guys found the solution? – Sanju Jan 10 '17 at 09:43
Doesn't work. Shall I use test.testdomain.com or something like: test.testdomain.com/some/path/here – Josh Jan 23 '17 at 15:41
I faced same issue even after adding above steps. – Nirmalsinh Rathod Mar 02 '17 at 03:58

score 9 · Answer 2 · answered Sep 30 '15 at 11:48

9

Add a new row in your plist file.

answered Sep 30 '15 at 11:48

pkc456

8,350
38
53
109

1

Perfect. Worked for me. It was easier to update seeing your image. Thanks :D – Reanimation Jun 30 '16 at 10:55

score 6 · Answer 3 · answered Sep 30 '15 at 16:04

6

I added this code in the info.plist to allow any request http:

 <key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/>
</dict>

This article lists all the changes made by Apple for iOS 9 and their implementations:

http://ste.vn/2015/06/10/configuring-app-transport-security-ios-9-osx-10-11/

answered Sep 30 '15 at 16:04

delarcomarta

263
3
9

I am having this in plist info by default but still it fails – Naga Oct 29 '18 at 18:37

score 1 · Answer 4 · answered Mar 18 '17 at 09:11

Add the following to the info.plist file. And replace 'My_Base_Url.com' with your web service link's base url. This should do the trick.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>My_Base_Url.com</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSExceptionMinimumTLSVersion</key>
            <string>TLSv1.2</string>
            <key>NSExceptionRequiresForwardSecrecy</key>
            <true/>
            <key>NSIncludesSubdomains</key>
            <true/>
            <key>NSRequiresCertificateTransparency</key>
            <false/>
            <key>NSThirdPartyExceptionAllowsInsecureHTTPLoads</key>
            <false/>
            <key>NSThirdPartyExceptionMinimumTLSVersion</key>
            <string>TLSv1.2</string>
            <key>NSThirdPartyExceptionRequiresForwardSecrecy</key>
            <true/>
        </dict>
    </dict>
</dict>

score 1 · Answer 5 · answered Dec 06 '18 at 08:01

1

If your app includes H5 page, sometimes it also will have this error.
It doesn't only require to turn on Allow Arbitrary Loads to fix it, but also require to add code below in your appDelegate.m:


@implementation NSURLRequest(ATS)
+ (BOOL)allowsAnyHTTPSCertificateForHost:(NSString *)host
{
    return YES;
}
@end

answered Dec 06 '18 at 08:01

scorpiozj

2,687
5
34
60

How could I add it to my AppDelegate in xamarin forms ? – Pxaml Jul 16 '19 at 14:29
@Pxaml, not familiar with xamarin. The code implements a NSURLRequest category. You can check how to add a category in xamarin. – scorpiozj Jul 18 '19 at 07:09

score 0 · Answer 6 · answered Sep 29 '15 at 06:52

0

According to this: https://forums.developer.apple.com/message/36842#36842

The correct exception to fix HTTP load failed (kCFStreamErrorDomainSSL, -9802) is:

NSExceptionAllowsInsecureHTTPLoads

answered Sep 29 '15 at 06:52

spirographer

630
4
18

1

That case is interesting - thanks for sharing. In my case, this error was due to server not supporting forward secrecy. We ultimately fixed the cipher suite list in our server end to support FwSec and that fixed the app (and exception '..ExceptionRequiresForwardSecrecy' was no longer needed). – Vignesh Murugesan Sep 29 '15 at 14:37
Our case was due to having a self signed certificate in our test virtual machine. – spirographer Sep 30 '15 at 01:58
@spirographer - so how did you get your self-signed certificate on your VM to work? – ness-EE Feb 21 '16 at 15:18
@ness-EE I totally recommend using https://letsencrypt.org/ now that they are launched. That way you don't need any exceptions to support VM differently than production. – spirographer Feb 22 '16 at 23:01

HTTPS request in iOS 9 : NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)

6 Answers6

Linked

Related