在 iOS 9 中通过 HTTPS 通过 IP 地址连接到服务器时出现 kCFStreamErrorDomainSSL，-9802
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/30778579/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
kCFStreamErrorDomainSSL, -9802 when connecting to a server by IP address through HTTPS in iOS 9
提问by Ryan Fung
We have an iOS app that connects to our server through HTTPS. When the app is built with the new iOS 9 SDK and ran under iOS 9, the following error occurs:
我们有一个 iOS 应用程序，它通过 HTTPS 连接到我们的服务器。当应用使用新的iOS 9 SDK构建并在iOS 9下运行时，出现以下错误：
NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)
The app uses AFNetworking 1.3.4 with pinned certs. The problem occurs if I connect to the server with its IP address. It works if I add the NSAllowsArbitraryLoadsconfig, or if I connect to the server with its domain name.
该应用程序使用带有固定证书的 AFNetworking 1.3.4。如果我使用其 IP 地址连接到服务器，则会出现问题。如果我添加NSAllowsArbitraryLoads配置，或者如果我使用其域名连接到服务器，它就可以工作。
The Tomcat connector is configured with sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2".
Tomcat 连接器配置了 sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"。
I have tried overriding the host namebut it doesn't seem to change anything.
我试过覆盖主机名，但它似乎没有改变任何东西。
I can't find much official documentation on ATS yet. Maybe connecting with IP address is not supposed to work?
我还找不到很多关于 ATS 的官方文档。也许使用 IP 地址连接不应该工作？
回答by zaph
iOS9 requires the server to only support TLSv1.2 and support perfect forward security.
iOS9 要求服务器只支持TLSv1.2，并支持完善的前向安全。
Also required is for the app to support IPV6 including not using hard-coded IP addresses. Suggested is to use NSURLSession. Otherwise exception additions must be made in the app plist.
应用程序还需要支持 IPV6，包括不使用硬编码的 IP 地址。建议是使用NSURLSession. 否则必须在应用程序 plist 中添加异常。
See the WWDC-15 session "Security and your Apps".
请参阅 WWDC-15 会议“安全性和您的应用程序”。
Also see Steven Peterson's Blogfor details.
另请参阅Steven Peterson 的博客了解详细信息。
回答by comonitos
You can add this in your "Info.plist" file, it will allow non secured connections:
您可以将其添加到“ Info.plist”文件中，它将允许非安全连接：
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<true/>
</dict>
回答by Litome
I found another stack overflow answer with a checklist of the exact new requirements on the server to full fill the iOS 9 default App Transport Security requirements: iOS 9 Security Server requirements Checklist
我找到了另一个堆栈溢出答案，其中包含服务器上确切新要求的清单，以完全满足 iOS 9 默认应用程序传输安全要求： iOS 9 安全服务器要求清单
Hope that helps.
希望有帮助。
回答by DamienB
I got stuck on this one for a while and tried all the tricks in Info.plist but still had the error:
我在这个问题上停留了一段时间并尝试了 Info.plist 中的所有技巧，但仍然出现错误：
HTTP load failed (kCFStreamErrorDomainSSL, -9813)
when trying to connect to a localhost server in development.
尝试连接到开发中的本地主机服务器时。
Developing locally with a react native project connecting to an API served with a self signed certificate I had my system set to trust the certificate but it took me a while to realise that I also needed the IOS simulator to accept my cert as trusted to get past this error.
使用连接到带有自签名证书的 API 的 React Native 项目在本地开发我将系统设置为信任该证书，但我花了一段时间才意识到我还需要 IOS 模拟器来接受我的证书作为受信任的证书才能通过这个错误。
In the home screen of your simulator you should be able to drag the cert file into the simulator to prompt it to add the certificate profile. Or, if the certificate is accessible through a localhost url in the simulator's safari browser you may be able to accept it through safari.
在模拟器的主屏幕中，您应该能够将证书文件拖到模拟器中以提示它添加证书配置文件。或者，如果证书可以通过模拟器的 safari 浏览器中的 localhost url 访问，您可以通过 safari 接受它。
Hope this helps someone as I went around in circles before it clicked for me!
希望这对我有所帮助，因为我在点击之前转了一圈！
回答by Jayprakash Dubey
Solution 1 :
解决方案1：
If you're looking for work aroundthen use below approach :
如果您正在寻找work around然后使用以下方法：
- Add NSAllowsArbitraryLoadskey of type booleanwith value true.
- 添加值为true 的boolean类型的NSAllowsArbitraryLoads键。
Your Info.plist file should look like this :
您的 Info.plist 文件应如下所示：
However, this approach is not recommended since it allows all unsecure connection.
但是，不推荐这种方法，因为它允许所有不安全的连接。
Solution 2 :
解决方案2：
The SSL certificate that you apply on Server should be of type TLSv2.0 minimum since iOS 10 requires this.Check this linkfor detail.
在SSL certificate that you apply on Server should be of type TLSv2.0 minimum since iOS 10 requires this.检查此链接查看详细。
- Add NSIncludesSubdomainskey of type booleanwith value true
- Add NSTemporaryExceptionAllowsInsecureHTTPLoadskey of type booleanwith value true
- Add NSTemporaryExceptionMinimumTLSVersionkey of type Stringwith value TLSv1.2
- 添加值为true 的布尔类型的NSIncludesSubdomains键
- 添加值为true 的布尔类型的NSTemporaryExceptionAllowsInsecureHTTPLoads键
- 添加值为TLSv1.2 的String类型的NSTemporaryExceptionMinimumTLSVersion键
Your Info.plist file should look like this :
您的 Info.plist 文件应如下所示：
