iOS9 SDK won't allow https call

Solar2D iOS
#1

When I build with 2015.2722 and iOS9 SDK and put it onto my device (running iOS 9.0.0) I get an error when trying to call this endpoint. I understand the the ATS restrictions on iOS9, but this is a major aws end point - not sure how it could be considered insecure?

\<Warning\>: ERROR: network request failed: https://sdb.eu-west-1.amazonaws.com/ [-1200: An SSL error has occurred and a secure connection to the server cannot be made.]

Is it possible to drop back to the old 8.4 SDK?

#2

@beernathan I think this thread might have a bit more information about this issue:

https://forums.coronalabs.com/topic/59340-ios-9-ats-in-laymans-terms/

#3

It likely is a certificate problem at Amazon.  There are some ATS options that tell it to work with certificate problems.

Rob

#4

Hmm, OK thanks I’ll put in an exception for now.

If I have to roll back to the old SDK in the short term, how do I do that?

#5

You would have to find an install of Xcode 6.4 to roll back to a version of Corona SDK before 2702.

Rob

#6

OK thanks Rob.

I put in an exception for that AWS url…

NSAppTransportSecurity = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; { &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSExceptionDomains = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; { &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;["sdb.eu-west-1.amazonaws.com"] = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSIncludesSubdomains = true, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSThirdPartyExceptionAllowsInsecureHTTPLoads = true &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }

but it’s still throwing an error…

ERROR: network request failed: https://sdb.eu-west-1.amazonaws.com/ [-1200: An SSL error has occurred and a secure connection to the server cannot be made.]
#7

I fixed it.

This doc is great: https://coronalabs.com/blog/2015/09/17/about-app-transport-security-ats/

But it only includes the exception for https. Turns out you can also include a min TLS version, and also an exception for the forward secrecy ciphers. 

There is a good apple doc here: https://developer.apple.com/library/prerelease/ios/technotes/App-Transport-Security-Technote/index.html

This is what I ended up using (the forward ciphers were the issue for me):

NSAppTransportSecurity = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSExceptionDomains = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; { &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;["sdb.eu-west-1.amazonaws.com"] = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSIncludesSubdomains = true, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSThirdPartyExceptionRequiresForwardSecrecy = false &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;},
#8

@beernathan I think this thread might have a bit more information about this issue:

https://forums.coronalabs.com/topic/59340-ios-9-ats-in-laymans-terms/

#9

It likely is a certificate problem at Amazon.  There are some ATS options that tell it to work with certificate problems.

Rob

#10

Hmm, OK thanks I’ll put in an exception for now.

If I have to roll back to the old SDK in the short term, how do I do that?

#11

You would have to find an install of Xcode 6.4 to roll back to a version of Corona SDK before 2702.

Rob

#12

OK thanks Rob.

I put in an exception for that AWS url…

NSAppTransportSecurity = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; { &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSExceptionDomains = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; { &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;["sdb.eu-west-1.amazonaws.com"] = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSIncludesSubdomains = true, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSThirdPartyExceptionAllowsInsecureHTTPLoads = true &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }

but it’s still throwing an error…

ERROR: network request failed: https://sdb.eu-west-1.amazonaws.com/ [-1200: An SSL error has occurred and a secure connection to the server cannot be made.]
#13

I fixed it.

This doc is great: https://coronalabs.com/blog/2015/09/17/about-app-transport-security-ats/

But it only includes the exception for https. Turns out you can also include a min TLS version, and also an exception for the forward secrecy ciphers. 

There is a good apple doc here: https://developer.apple.com/library/prerelease/ios/technotes/App-Transport-Security-Technote/index.html

This is what I ended up using (the forward ciphers were the issue for me):

NSAppTransportSecurity = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSExceptionDomains = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; { &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;["sdb.eu-west-1.amazonaws.com"] = &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSIncludesSubdomains = true, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NSThirdPartyExceptionRequiresForwardSecrecy = false &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;},