SSL Pinning with AFNetworking

Question

In my app I'm using https and a self-signed SSL certificate to secure the connection between my client and the server.

I was trying to have the AFNetworking library do SSL Pinning on a copy of my certificate bundled in the app.

In the AFURLConnectionOperation header I defined both:

#define _AFNETWORKING_ALLOW_INVALID_SSL_CERTIFICATES_ =1
#define _AFNETWORKING_PIN_SSL_CERTIFICATES_ =1

And before calling the start on my AFJSONRequestOperation I set the SSLPinningMode property to AFSSLPinningModeCertificate.

But when trying to perform a JSON request I keep getting the following error:

Error Domain=NSURLErrorDomain Code=-1012 "The operation couldn’t be completed. 
(NSURLErrorDomain error -1012.)" UserInfo=0x758f120 
{NSErrorFailingURLKey=https://mydomain.com,
NSErrorFailingURLStringKey=https://mydomain.com}

In the AFURLConnectionOperation header I read that the SSL Pinning works with .cer certificates but in my self-hosted OS X webserver I have a .crt certificate.

Is this the problem? Is there a way to make AFNetworking work with .crt?

On a windows box I converted my .crt to .cer and tried to bundle that into my app but I still get the same error. Should I try to switch the .crt file with the newly created .cer even on the server side?

Solution 1

I got it working.

I was in the situation where I had created a self-signed cert for to hit my own server API from my iOS App. I created my cert with OpenSSL. When I was done creating it, I had several files, one of which was "server.crt". Initially, I tried just renaming it to "server.cer", and using "AFSSLPinningModeCertificate" for my AFURLConnectionOperation objects. That did not work, and I noticed the example uses "AFSSLPinningModePublicKey", so I tried that, still no luck.

So I compared my file (that was the renamed ".crt" file) to his.
I noticed that "server.crt" was base64-encoded, and like this:

-----BEGIN CERTIFICATE-----
394230AFDFD... 
-----END CERTIFICATE-----

I noticed from Mattt's example in AFNetworking that the "adn.cer" file he uses is not base64-encoded. It is just raw bytes. So, I did this:

$ base64 -D -i ./server.crt -o ./server.cer

I set my AFURLConnectionOperation to AFSSLPinningModePublicKey.
I put that back in the project and did a clean and build of my iOS project, and everything worked fine.

Hope this helps!!

Btw, you may notice that Xcode will display info for for your ".crt" or ".cer" key whether it is the base64 or the raw one, so don't let that confuse you. You should be able to see the certificate data in either case, it's just that AF will only accept the raw (non-base64) one.

UPDATE:
Anyone having trouble with base64, this what works for me on OS X using OpenSSL:

$ openssl base64 -d -in ./server.crt -out ./server.cer

Solution 2

If you're using AFNetworking 2.x, and you're using the correct .cer but still receiving error code -1012 on your calls, you should disable validatesCertificateChain:

AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
securityPolicy.validatesCertificateChain = NO;

or you can pass it all in the entire certificate chain in pinnedCertificates.

Comments

[Voda Ion]

Your work around is correct one but, how to make it work without any .cer files? This is the question!

[CharlesA]

FYI, I had a problem using base64 to do the conversion. Instead I used 'openssl x509 -in test.crt -outform der -out test.cer'.

[nefarianblack]

Anyone getting confused regarding .cer | .crt etc., there is a nice post about it which will certainly clear your doubts. It also shows how to convert certificates to different formats.

[Ruhee Jaiswal]

@tanmaykhandelwal: That link is now broken, but I noticed the content was reposted on support.ssl.com.

[firebear]

I got an error when using base64 to do the conversion. localhost:pvk firebear$ base64 -D -i WS_CA1_xs_UTN-SGC.crt -o WS_CA1_xs_UTN-SGC.cer Invalid character in input stream. I also tried openssl, but still not work. :(

[jpswain]

@firebear I added an update to my post, hopefully that helps!

[firebear]

I tried 'openssl base64 -d -in ./server.crt -out ./server.cer' in Mac. Yes, it worked! thanks.

[lifemoveson]

@orange80 What if you have more than one certificate; would that work in the bundle ?

[jpswain]

@lifemoveson for the same host or different hosts? if they are all for the same host, i believe pinning to your own intermediate CA is probably the best solution, but that would require additional process for your organization to manage the CA signing.