How to check website certificate in Cocoa Touch?

Question

I am currently opening an https connection to a web server using NSURLConnection. Everything works as it should, and I can get the contents of the page that I use. The certificate is issued by VeriSign, and I assume that NSURLConnection does some work to certify the certificate to some extent? If I connected to the same website using a mobile safari, it will be extracted from the certificate and display the Organization (website) in the navigation bar. Is it possible to extract the same data in Cocoa Touch, since I would also like to present it to the user? In addition, would it be sufficient to verify the correct hostname of the servers with respect to this certificate to assume that the site is legal?

Answer 1

NSURLConnection will give you an error message ( NSURLErrorDomain ) if you try to connect to a server with an invalid certificate (for example, it is self-signed, outdated, has the wrong host, etc.). That way, you really don't need to do any checks yourself, because all this is being processed for you.

If you really need / need to display a summary of SSL certificates in the user interface, you will need to drop the layer from NSURLConnection and use the low-level CFNetwork API. If you have a CFReadStreamRef that is in state kCFStreamEventEndEncountered , you should be able to do the following (if your stream descriptor is called readStream ):

 NSArray* certificates = [(NSArray*)CFReadStreamCopyProperty(readStream, kCFStreamPropertySSLPeerCertificates) autorelease]; if ([certificates count] > 0) { SecCertificateRef certificate = (SecCertificateRef)[certificates objectAtIndex:0]; NSString* description = [(NSString*)SecCertificateCopySubjectSummary(certificate) autorelease]; NSData* data = [(NSData*)SecCertificateCopyData(certificate) autorelease]; } 

You will need to decode the information stored in data if you want to access the various properties of the certificate, but the summary contained in the description may be enough for your purposes.