title: What is the reason of kSecTrustResultRecoverableTrustFailure?
body: <p>I'd like to validate my ssl server certificates with some extra checks. And sometimes I get a </p>
  
  <pre><code>kSecTrustResultRecoverableTrustFailure 
  </code></pre>
  
  <p>instead of </p>
  
  <p><code>kSecTrustResultProceed</code> or <code>kSecTrustResultUnspecified</code></p>
  
  <p>It seems to happen if</p>
  
  <ul>
  <li>the certificate is md5 hashed (IOS5)</li>
  <li>the server does not present the root and intermediate certificates</li>
  <li>the <code>SecTrustSetAnchorCertificatesOnly(trust,YES)</code> 
  is set and the anchor certificate is only in the built in anchor certificates</li>
  <li>the certificate is expired</li>
  <li>?</li>
  </ul>
  
  <p>It depends on the AppleX509TP policy used to evaluate the trust.</p>
  
  <p>My problem is I do not want to trust if the chain fails, but I want to trust if MD5 is used.</p>
  
  <p>Is there a way to find out why the evaluation failed?</p>
  
  <p>As an alternative is there a way to extract the <code>CSSM_ALGID_MD5</code> from a <code>SecCertificateRef</code>?</p>