CFNetwork and SSL Certificate Exceptions
CFNetwork and SSL Certificate Exceptions
- Subject: CFNetwork and SSL Certificate Exceptions
- From: Rich Siegel <email@hidden>
- Date: Sun, 11 Sep 2005 10:43:50 -0400
Hi all,
I'm in the process of converting some ancient Open Transport networking
over to use CFNetwork. It's going great, except for the SSL support. In
the old world, if a certificate error occurred (untrusted root, expired
certificate, peer name mismatch, etc), I had (primitive) code which
presented the UI for resolving the problem and retried the connection.
In the new world, I'm using CFNetwork, so it's all different. (If an
error occurs during SSL handshaking, the connection must be closed
before the handshake can be reattempted. This makes life interesting
when doing the handshake in the context of a stateful protocol
connection, like SMTP.)
So, I have questions:
1) From my (admittedly limited) exploration, it looks like CFNetwork
doesn't have any support for presenting a standard UI for asking the
user how to resolve certificate exceptions. (The observed divergence
in behavior between Apple Mail and Safari seems to bear this out.)
Is that correct, or have I missed something?
2) Since kCFStreamPropertySSLSettings is only supported on 10.4 and
later, this tells me that I need to hand-roll my own SSL code using
Secure Transport, because my app needs to run on pre-10.4 systems
(10.3.9, to be exact). This isn't the end of the world, because
I've done it once before, but I'm hoping that I can avoid having
to do it again. Is there a supported way to manage SSL handshake
options for a CFStream on 10.3.x?
On a related matter: is there any example code which demonstrates how to
extract certificate chain info from a SecureTransport SSLContextRef and
display it to the user?
Thanks very much for any advice or pointers.
R.
--
Rich Siegel Bare Bones Software, Inc.
<email@hidden> <http://www.barebones.com/>
Someday I'll look back on all this and laugh... until they sedate me.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macnetworkprog mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden