<p>Using <strong>NSURLRequest</strong>, I am trying to access a web site that has an expired certificate. When I send the request, my <strong>connection:didFailWithError</strong> delegate method is invoked with the following info:</p>

<pre><code>-1203, NSURLErrorDomain, bad server certificate
</code></pre>

<p>My searches have only turned up one solution: a hidden class method in NSURLRequest:</p>

<pre><code>[NSURLRequest setAllowsAnyHTTPSCertificate:YES forHost:myHost];
</code></pre>

<p>However, I don't want to use private APIs in a production app for obvious reasons.</p>

<p>Any suggestions on what to do? Do I need to use CFNetwork APIs, and if so, two questions:</p>

<ul>
<li>Any sample code I can use to get started? I haven't found any online.</li>
<li>If I use CFNetwork for this, do I have to ditch NSURL entirely?</li>
</ul>

<hr>

<p>EDIT:</p>

<p>iPhone OS 3.0 introduced a supported method for doing this. More details here: <a href="https://stackoverflow.com/questions/933331/how-to-use-nsurlconnection-to-connect-with-ssl-for-an-untrusted-cert">How to use NSURLConnection to connect with SSL for an untrusted cert?</a></p>

[{'answer_id': 15963, 'author': 'Matthew Schinckel', 'author_id': 188, 'author_profile': 'https://Stackoverflow.com/users/188', 'pm_score': 1, 'selected': False, 'text': '<p>I\'ve hit the same issue - I was developing a SOAP client, and the dev server has a "homegrown" certificate.  I wasn\'t able to solve the issue even using that method, since I wasn\'t using NSURL, but the (poorly documented and apparently abandoned) WS methods, and decided for the time being to (internally) just use a non-SSL connection.</p>\n\n<p>Having said that, however, the question that springs to mind is, if you aren\'t willing to use a private API in a production app, should you be allowing access to a site with a dodgy certificate?</p>\n\n<p>I\'ll quote <a href="http://www.cocoabuilder.com/archive/message/cocoa/2008/3/4/200413" rel="nofollow noreferrer">Jens Alfke</a>:</p>\n\n<blockquote>\n  <p>That\'s not just a theoretical security problem. Something<br>\n  like 25% of public DNS servers have been compromised, according to<br>\n  recent reports, and can direct users to phishing/malware/ad sites even<br>\n  if they enter the domain name properly. The only thing protecting you<br>\n  from that is SSL certificate checking.</p>\n</blockquote>\n'}, {'answer_id': 20480, 'author': 'David Schlosnagle', 'author_id': 1750, 'author_profile': 'https://Stackoverflow.com/users/1750', 'pm_score': 1, 'selected': False, 'text': '<p>Can you create a self signed certificate and add your custom certificate authority to the trusted CAs? I\'m not quite sure how this would work on the iPhone, but I\'d assume on Mac OS X you would add these to the Keychain.</p>\n\n<p>You may also be interested in this post <a href="http://www.cocoabuilder.com/archive/message/cocoa/2008/5/22/207740" rel="nofollow noreferrer">Re: How to handle bad certificate error in NSURLDownload</a></p>\n'}, {'answer_id': 215532, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 2, 'selected': False, 'text': "<p>If it's for an internal server for testing purposes, why not just import the test server's certificate into the KeyChain and set custom trust settings?</p>\n"}, {'answer_id': 245903, 'author': 'Louis Gerbarg', 'author_id': 30506, 'author_profile': 'https://Stackoverflow.com/users/30506', 'pm_score': 3, 'selected': False, 'text': '<p>The supported way of doing this requires using CFNetwork. You have to do is attach a kCFStreamPropertySSLSettings to the stream that specifies kCFStreamSSLValidatesCertificateChain == kCFBooleanFalse. Below is some quick code that does it, minus checking for valid results add cleaning up. Once you have done this You can use CFReadStreamRead() to get the data.</p>\n\n<pre><code>CFURLRef myURL = CFURLCreateWithString(kCFAllocatorDefault, CFSTR("http://www.apple.com"), NULL);\nCFHTTPMessageRef myRequest = CFHTTPMessageCreateRequest(kCFAllocatorDefault, CFSTR("GET"), myURL, kCFHTTPVersion1_1);\nCFReadStreamRef myStream = CFReadStreamCreateForHTTPRequest(kCFAllocatorDefault, myRequest);\nCFMutableDictionaryRef myDict = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &amp;kCFTypeDictionaryKeyCallBacks, &amp;kCFTypeDictionaryValueCallBacks);\nCFDictionarySetValue(myDict, kCFStreamSSLValidatesCertificateChain, kCFBooleanFalse);\nCFReadStreamSetProperty(myStream, kCFStreamPropertySSLSettings, myDict);    \nCFReadStreamOpen(myStream);\n</code></pre>\n'}, {'answer_id': 309821, 'author': 'chews', 'author_id': 33966, 'author_profile': 'https://Stackoverflow.com/users/33966', 'pm_score': 0, 'selected': False, 'text': '<p>Another option would be to use an alternate connection library.</p>\n\n<p>I am a huge fan of AsyncSocket and it has support for self signed certs</p>\n\n<p><a href="http://code.google.com/p/cocoaasyncsocket/" rel="nofollow noreferrer">http://code.google.com/p/cocoaasyncsocket/</a></p>\n\n<p>Take a look, I think it is way more robust then the standard NSURLRequests.</p>\n'}, {'answer_id': 2195434, 'author': 'Mike McMaster', 'author_id': 544, 'author_profile': 'https://Stackoverflow.com/users/544', 'pm_score': 3, 'selected': True, 'text': '<p>iPhone OS 3.0 introduced a supported way of doing this that doesn\'t require the lower-level CFNetwork APIs. More details here:</p>\n\n<p><a href="https://stackoverflow.com/questions/933331/how-to-use-nsurlconnection-to-connect-with-ssl-for-an-untrusted-cert">How to use NSURLConnection to connect with SSL for an untrusted cert?</a></p>\n'}]
['https://Stackoverflow.com/questions/15266', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/544/']