title: ios9 self signed certificate and app transport security
body: <p>I've spent a while trying to get this working. I have an API that I'm connecting to that i'm trying to switch to SSL with self signed certificates. I have control on the server and app.</p>
  
  <p>I generated a self signed cert according to this:</p>
  
  <p><a href="https://kyup.com/tutorials/create-ssl-certificate-nginx/" rel="nofollow">https://kyup.com/tutorials/create-ssl-certificate-nginx/</a></p>
  
  <pre><code>sudo openssl genrsa -des3 -out ssl.key 2048
  sudo openssl req -new -key ssl.key -out ssl.csr
  sudo cp ssl.key ssl.key.orig &amp; sudo openssl rsa -in ssl.key.orig -out ssl.key
  sudo openssl x509 -req -days 365 -in ssl.csr -signkey ssl.key -out ssl.crt
  </code></pre>
  
  <p>I've tried some config options on the server (NGINX)</p>
  
  <pre><code>ssl on;
  ssl_certificate /etc/nginx/ssl/ssl.crt;
  ssl_certificate_key /etc/nginx/ssl/ssl.key;
  ssl_session_timeout 5m;
  ssl_protocols  SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers HIGH:!aNULL:!MD5;
  #ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
  ssl_prefer_server_ciphers on;
  </code></pre>
  
  <p>And on the client side I've tried some different options with ATS:</p>
  
  <pre><code>&lt;key&gt;NSAppTransportSecurity&lt;/key&gt;
  &lt;dict&gt;
      &lt;key&gt;NSAllowsArbitraryLoads&lt;/key&gt;
      &lt;true/&gt;
  &lt;/dict&gt;
  </code></pre>
  
  <p>and</p>
  
  <pre><code>&lt;key&gt;NSAppTransportSecurity&lt;/key&gt;
  &lt;dict&gt;
      &lt;key&gt;NSAllowsArbitraryLoads&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;NSExceptionDomains&lt;/key&gt;
      &lt;dict&gt;
          &lt;key&gt;test.example.com (NOT REALLY MY DOMAIN)&lt;/key&gt;
          &lt;dict&gt;
              &lt;key&gt;NSExceptionAllowsInsecureHTTPLoads&lt;/key&gt;
              &lt;true/&gt;
          &lt;/dict&gt;
      &lt;/dict&gt;
  &lt;/dict&gt;
  </code></pre>
  
  <p>and</p>
  
  <pre><code>&lt;key&gt;NSAppTransportSecurity&lt;/key&gt;
  &lt;dict&gt;
      &lt;key&gt;NSAllowsArbitraryLoads&lt;/key&gt;
      &lt;true/&gt;
      &lt;key&gt;NSExceptionDomains&lt;/key&gt;
      &lt;dict&gt;
          &lt;key&gt;test.example.com (NOT REALLY MY DOMAIN)&lt;/key&gt;
          &lt;dict&gt;
              &lt;key&gt;NSExceptionAllowsInsecureHTTPLoads&lt;/key&gt;
              &lt;true/&gt;
              &lt;key&gt;NSExceptionRequiresForwardSecrecy&lt;/key&gt;
              &lt;false/&gt;
              &lt;key&gt;NSExceptionMinimumTLSVersion&lt;/key&gt;
              &lt;string&gt;TLSv1.1&lt;/string&gt;
          &lt;/dict&gt;
      &lt;/dict&gt;
  &lt;/dict&gt;
  </code></pre>
  
  <p>Depending on different ATS options I get errors:</p>
  
  <pre><code>An SSL error has occurred and a secure connection to the server cannot be made.
  </code></pre>
  
  <p>or</p>
  
  <pre><code>NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)
  The certificate for this server is invalid. You might be connecting to a server that is pretending to be “MYDOMAIN” which could put your confidential information at risk.
  </code></pre>
  
  <p>Any ideas? Anyone else struggle with self signed certs?</p>
  
  <p>P.S. I'm on OS X 10.11.2 Beta, Xcode 7.1.1</p>