ASIHTTPRequest.validatesSecureCertificate once set to NO can never be reverted

[ikarius]

Hi all,

Title is self explanatory.

If 'validatesSecureCertificate' is set to NO once, it can never be reverted, even on new requests.

Tried this test case:

-(void)testValidateSSLCertificateTwice
{
    NSURL *url = [[[NSURL alloc] initWithString:@"https://someselfsignedurl"] autorelease];
    ASIHTTPRequest *request = [[[ASIHTTPRequest alloc] initWithURL:url] autorelease];
    // Setup onee
    request.validatesSecureCertificate = NO;
    [request startSynchronous];

    BOOL success = [request error] == nil && [request complete];


    GHAssertTrue(success, @"SSL error: should NOT have error");

    request = nil;

    request = [[[ASIHTTPRequest alloc] initWithURL:url] autorelease];
    request.validatesSecureCertificate = YES;
    [request startSynchronous];

    success = [request error] != nil;

    GHAssertTrue(success, @"SSL error: should have a NSError and no response data");
}

This is somehow related to kCFStreamPropertySSLSettings / kCFStreamSSLValidatesCertificateChain that can never be reverted once set to true.

[shezban]

I am facing the same issue even with v1.8.1-61 2011-09-19, which is having the code fixes as said above in Ref "6600374".
Any solution of this particular issue.

Thanks

[shezban]

Issue is, library is not reverting the SSL properties, when user resets validatesSecureCertificate from NO to YES. Though user is saying to perform SSL validation but at OS level, SSL properties are set for not to perform SSL validation [sets when validatesSecureCertificate sets as NO] . Hence library is not giving any error with self-signed certificates and validatesSecureCertificate as YES.

Solution for this is as follows:

• (void)startRequest
  {

  ---

  //
  // Handle SSL certificate settings
  //

  if([[[[self url] scheme] lowercaseString] isEqualToString:@"https"]) {

  // Tell CFNetwork not to validate SSL certificates
  if (![self validatesSecureCertificate]) {
      // see: http://iphonedevelopment.blogspot.com/2010/05/nsstream-tcp-and-ssl.html
  
      NSDictionary *sslProperties = [[NSDictionary alloc] initWithObjectsAndKeys:
                                [NSNumber numberWithBool:YES], kCFStreamSSLAllowsExpiredCertificates,
                                [NSNumber numberWithBool:YES], kCFStreamSSLAllowsAnyRoot,
                                [NSNumber numberWithBool:NO],  kCFStreamSSLValidatesCertificateChain,
                                kCFNull,kCFStreamSSLPeerName,
                                nil];
  
      CFReadStreamSetProperty((CFReadStreamRef)[self readStream], 
                              kCFStreamPropertySSLSettings, 
                              (CFTypeRef)sslProperties);
      [sslProperties release];
  } 
  

  /* Need to add this else loop - Following needs to add to revert back the SSL settings */
  else {
  NSDictionary *sslProperties = [[NSDictionary alloc] initWithObjectsAndKeys:
  [NSNumber numberWithBool:NO], kCFStreamSSLAllowsExpiredCertificates,
  [NSNumber numberWithBool:NO], kCFStreamSSLAllowsAnyRoot,
  [NSNumber numberWithBool:YES], kCFStreamSSLValidatesCertificateChain,
  nil];

      CFReadStreamSetProperty((CFReadStreamRef)[self readStream], 
                              kCFStreamPropertySSLSettings, 
                              (CFTypeRef)sslProperties);
      [sslProperties release];            
  }
  

  ---

}

Thanks
Shivani

[ikarius]

Hi Shivani,

A patch (merely identical to your code), has already been submitted and merged.

[jogu]

Closing based on ikarius's comment