0

I create a custom manager in my class. I then make all requests using that manager, but I'm still getting an SSL validation error. I thought disabling evaluation would stop me receiving this error. Is something wrong with my custom manager? 

//Custom Alamofire manager
        private static var Manager : Alamofire.SessionManager = {
            // Create the server trust policies
            let serverTrustPolicies: [String: ServerTrustPolicy] = [
                "https://website.com": .disableEvaluation
            ]
            // Create custom manager
            let configuration = URLSessionConfiguration.default
            configuration.httpAdditionalHeaders = Alamofire.SessionManager.defaultHTTPHeaders
            let man = Alamofire.SessionManager(
                configuration: configuration,
                serverTrustPolicyManager: ServerTrustPolicyManager(policies: serverTrustPolicies)
            )
            return man
        }()

My requests look like this:

ViewController.Manager.request("https://website.com", method: .post, parameters: parameters, encoding:JSONEncoding.default)
            .responseString { response in... }
SuperHanz98
  • 2,090
  • 2
  • 16
  • 33
  • added `NSAllowsArbitraryLoads` to `true` in **info.plist** – Shehata Gamal Jul 18 '19 at 14:11
  • `NSAppTransportSecurity NSAllowsArbitraryLoads ` – Shehata Gamal Jul 18 '19 at 14:17
  • Okay that's changed the error description I'm getting but it still implies basically the same thing: 'The certificate for this server is invalid. You might be connecting to a server that is pretending to be “blahblah.com” which could put your confidential information at risk.' – SuperHanz98 Jul 18 '19 at 14:22
  • Before that change, the error was 'An SSL error has occurred and a secure connection to the server cannot be made'. So basically the same thing, but a step in the right direction I suppose – SuperHanz98 Jul 18 '19 at 14:24
  • Disabling evaluation through Alamofire just disables the local validation, it does not disable the system default validation through ATS. Do not use the `NSAllowsArbitraryLoads` setting, instead you should investigate and see why your connection isn't valid. You can use the `nscurl` command line tool's `--ats-diagnostics` flag to use it to check various SSL settings. – Jon Shier Jul 18 '19 at 16:50
  • @JonShier Hi Jon, I appreciate your comment, thank you. However, I know why the connection is invalid, it is because the SSL cert is self signed by the company because it is just a REST API with no need for a full SSL cert. The only way I can access the site is by adding it to my trusted sites in keychain/advanced browser settings. I was hoping I could automate this process through Swift & Alamofire by simply disabling evaluation of the URL. Otherwise users of my program will have to manually go through this process with over 50 URLS... – SuperHanz98 Jul 19 '19 at 07:09
  • Even self signed certificates must pass the ATS checks unless you disable them. You need to investigate the particular error you're seeing. – Jon Shier Jul 19 '19 at 18:30

0 Answers0