title: How do you bypass SSL security errors in iOS apps?
body: <p>I'm trying to connect to an ASP.NET MVC server from iOS but since I am running it locally I don't have a real certificate for it. I can browse to the HTTPS URL I am connecting to, but Simulator throws errors when connecting via my Objective-C code. How can I bypass these SSL errors? I need to test some server-side stuff based on the encoding/connections sent from the Simulator.</p>
  
  <p>I have this error:</p>
  
  <pre><code>CFNetwork SSLHandshake failed (-9806)
  NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9806)
  </code></pre>
  
  <p>I tried this:</p>
  
  <pre><code>&lt;key&gt;NSAppTransportSecurity&lt;/key&gt;
  &lt;dict&gt;
      &lt;key&gt;NSAllowsArbitraryLoads&lt;/key&gt;
      &lt;true/&gt;
  &lt;/dict&gt;
  </code></pre>
  
  <p>But it didn't work. My logic is pretty simple, I just use your standard <code>NSURLSessionDataTask</code> objects:</p>
  
  <pre><code>NSURLSessionDataTask *getTask = [self.session dataTaskWithRequest:getRequest completionHandler: ^(NSData *data, NSURLResponse *response, NSError *error) {
  
  }];
  </code></pre>
  
  <p>I also tried using <code>NSURLSessionDelegate</code>:</p>
  
  <pre><code>self.session = [NSURLSession sessionWithConfiguration:[NSURLSessionConfiguration defaultSessionConfiguration] delegate:self delegateQueue:[NSOperationQueue mainQueue]];
  </code></pre>
  
  <p>...</p>
  
  <pre><code>- (void)URLSession:(NSURLSession *)session didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *credential))completionHandler {
      NSURLCredential *credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust];
      completionHandler(NSURLSessionAuthChallengeUseCredential, credential);
  }
  </code></pre>
  
  <p>But <code>didReceiveChallenge</code> is never called...</p>
  
  <p>I even tried installing the certificate in Simulator by dragging it in PLUS browsing to my server in Safari and trusting the certificate it presented, but even that didn't work.</p>