3

While adding a client certificate to an iOS application, I'm encountering a recoverable trust failure with the cert. The iOS docs discussion for SecTrustEvaluate specifically suggests using SecTrustGetTrustResult() to get the specifics of the failure, but the linker fails on reference to it. (It's not in any of the iOS-related header files, and there are no specific iOS docs for the function, only the mention in SecTrustGetTrustResult. A response in another, recent stackoverflow question says it's not available on iOS, but without any supporting details.) Assuming that it, in fact, is not available, what's the right way in my iOS code to get specific details about the recoverable failure?

(That iOS manual also mentions SecTrustGetCssmResult for the same purpose. I haven't tried it yet, but it also is not mentioned in any way in the iOS 5.1 header files, nor are there any iOS document entries dedicated to the function. Furthermore, the Mac OS X documentation, which does have details, marks it - and related SecTrustGetCssmResultCode - as deprecated.)

Final notes: since we run both the server and the client, we are using a privately crafted cert, and I believe we can regenerate the cert at will. I didn't generate the one I'm currently using, so am not sure about its pedigree. In case it's relevant, I'm trying to compile using Xcode 4.3.3 with iPhone 5.1 or iPad 5.1 simulator targets.

Thanks for any leads!

Community
  • 1
  • 1
klm
  • 712
  • 6
  • 8
  • Neither SecTrustGetCssmResult nor SecTrustGetCssmResultCode seem to be available on iOS, as well. (I neglected to mention that my code imports Security/Security.h.) – klm Aug 20 '12 at 18:24
  • I've learned that the certificate I'm integrating is in commission in other clients, so we can't swap in a new one. At least I know it works. – klm Aug 25 '12 at 18:39
  • In the [Certificate, Key, and Trust Services Reference doc](https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html#//apple_ref/c/func/SecTrustEvaluate) it states that `SecTrustGetTrustResult` is only available on Mac OS X and not on iOS. – Eric Allam Mar 11 '14 at 14:59

1 Answers1

0

@constant kSecTrustResultRecoverableTrustFailure Indicates a trust policy failure which can be overridden by the user. This value may be returned by the SecTrustEvaluate function but not stored as part of the user trust settings.

So it seems that you could treat this as .proceed.

Anton Tropashko
  • 5,486
  • 5
  • 41
  • 66