How to check the security of the SSL certificate in iOS?

Question

I wanna check whether the SSL certificate is present in the URL also wants to check its version and validation type.

I have created a application where I am calling the NSURLConnection delegate methods to send request over a server.

Also used "canAuthenticateAgainstProtectionSpace" method, but this method is not getting called once the connection is established.

How do I achieve this?

Answer 1

iOS does not give you very granular access to certificate information. You have two choices: private APIs or build your own evaluator with OpenSSL.

You can see the private certificate functions in the opensource code. The version is available from SecCertificateVersion(). I'm not certain what you mean by "validation type" here.

To do this with OpenSSL, you can get the DER data with SecCertificateCopyData() and then parse everything yourself.

I suggest opening a radar (bugreporter.apple.com) on this issue. The lack of access to basic information about the certificate is a serious problem.

If you're looking for sample code that extracts the certificate from the NSURLConnection, see the Chapter 11 sample code from iOS:PTL:

- (void)connection:(NSURLConnection *)connection
  willSendRequestForAuthenticationChallenge:
  (NSURLAuthenticationChallenge *)challenge
{
  NSURLProtectionSpace *protSpace = challenge.protectionSpace;
  SecTrustRef trust = protSpace.serverTrust;
  ...
    SecCertificateRef cert = SecTrustGetCertificateAtIndex(trust, 0);
  ...

At this point, cert holds your leaf certificate.