title: SecTrustEvaluate always returns kSecTrustResultRecoverableTrustFailure with SecPolicyCreateSSL
body: <p>My application tries to evaluate a server trust certificate for a self signed certificate. This is working fine with SecPolicyCreateBasicX509 but not working for SecPolicyCreateSSL</p>
  
  <p>Here is my code:</p>
  
  <pre><code>if (challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust) {
          // create trust from protection space
          SecTrustRef trustRef;
          int trustCertificateCount = SecTrustGetCertificateCount(challenge.protectionSpace.serverTrust);
  
          NSMutableArray* trustCertificates = [[NSMutableArray alloc] initWithCapacity:trustCertificateCount];
          for (int i = 0; i &lt; trustCertificateCount; i++) {
              SecCertificateRef trustCertificate =  SecTrustGetCertificateAtIndex(challenge.protectionSpace.serverTrust, i);
              [trustCertificates addObject:(id) trustCertificate];
          }            
  
          // set evaluation policy
          SecPolicyRef policyRef;
          // policyRef = SecPolicyCreateBasicX509(); this is working
          policyRef = SecPolicyCreateSSL(NO, (CFStringRef)             
          SecTrustCreateWithCertificates((CFArrayRef) trustCertificates, policyRef, &amp;trustRef);
  
          [trustCertificates release];
  
          // load known certificates from keychain and set as anchor certificates
          NSMutableDictionary* secItemCopyCertificatesParams = [[NSMutableDictionary alloc] init];    
          [secItemCopyCertificatesParams setObject:(id)kSecClassCertificate forKey:(id)kSecClass];
          [secItemCopyCertificatesParams setObject:@"Server_Cert_Label" forKey:(id)kSecAttrLabel];
          [secItemCopyCertificatesParams setObject:(id)kCFBooleanTrue forKey:(id)kSecReturnRef];
          [secItemCopyCertificatesParams setObject:(id)kSecMatchLimitAll forKey:(id)kSecMatchLimit];
  
          CFArrayRef certificates;
          certificates = nil;
          SecItemCopyMatching((CFDictionaryRef) secItemCopyCertificatesParams, (CFTypeRef*) &amp;certificates);
  
          if (certificates != nil &amp;&amp; CFGetTypeID(certificates) == CFArrayGetTypeID()) {
              SecTrustSetAnchorCertificates(trustRef, certificates);
              SecTrustSetAnchorCertificatesOnly(trustRef, NO);
          }
  
          SecTrustResultType result;
          OSStatus trustEvalStatus = SecTrustEvaluate(trustRef, &amp;result);
          if (trustEvalStatus == errSecSuccess) {
              if (result == kSecTrustResultConfirm || result == kSecTrustResultProceed || result == kSecTrustResultUnspecified) {
                  // evaluation OK
                  [challenge.sender useCredential:[NSURLCredential credentialForTrust: challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
              } else {
                  // evaluation failed 
                  // ask user to add certificate to keychain
          } else {
              // evaluation failed - cancel authentication
              [[challenge sender] cancelAuthenticationChallenge:challenge];
          }
  }
  </code></pre>
  
  <p>After a lot of research i have already made changes to the self-signed certificate by adding extension like mentioned in this post: <a href="https://stackoverflow.com/questions/3551643/unable-to-trust-a-self-signed-certificate-on-iphone">Unable to trust a self signed certificate on iphone</a></p>
  
  <p>Does anyone have another hint what might be missing here?</p>