iphone - Determining Trust With NSURLConnection and NSURLProtectionSpace -

good day everyone,

i ask followup question posed question. i've got code create nsurlrequest/connection, run , have callback methods authentication called. here's specific code:

- (bool)connection:(nsurlconnection *)connection canauthenticateagainstprotectionspace:(nsurlprotectionspace *)protectionspace {     return [protectionspace.authenticationmethod isequaltostring:nsurlauthenticationmethodservertrust] || [protectionspace.authenticationmethod isequaltostring:nsurlauthenticationmethoddefault]; }  -(void)connection:(nsurlconnection *)connection didreceiveauthenticationchallenge:(nsurlauthenticationchallenge *)challenge {         if ([challenge previousfailurecount] > 0) {         [[challenge sender] cancelauthenticationchallenge:challenge];         nslog(@"bad username or password");         badusernameandpassword = yes;         finished = yes;         return;     }      if ([challenge.protectionspace.authenticationmethod isequaltostring:nsurlauthenticationmethodservertrust])     {         if (appdelegate._allowinvalidcert)         {             // go ahead...trust me!             [challenge.sender usecredential:              [nsurlcredential credentialfortrust: challenge.protectionspace.servertrust]                   forauthenticationchallenge: challenge];         }         else         {             trustgenerator *tg = [[trustgenerator alloc] init];              if ([tg gettrust:challenge.protectionspace])             {                 // go ahead...trust me!                 [challenge.sender usecredential:                  [nsurlcredential credentialfortrust: challenge.protectionspace.servertrust]                       forauthenticationchallenge: challenge];             }             else {                 [[challenge sender] cancelauthenticationchallenge:challenge];             }         }     }     else if ([[challenge protectionspace] authenticationmethod] == nsurlauthenticationmethoddefault) {         nsurlcredential *newcredential = [nsurlcredential credentialwithuser:_username password:_password persistence:nsurlcredentialpersistencenone];         [[challenge sender] usecredential:newcredential forauthenticationchallenge:challenge];     } } 

what i'm running "didreceiveauthenticationchallenge" "[challenge.protectionspace.authenticationmethod isequaltostring:nsurlauthenticationmethodservertrust]" always being called, when certificate on server i'm attempting connect trusted (doing testing verisign cert). i'm seeing application prompting end user trust when website trusted. bad karma considering that's what's suppose happen man in middle attack, etc. i'm looking code this:

        if (appdelegate._allowinvalidcert)         {             // go ahead...trust me!             [challenge.sender usecredential:              [nsurlcredential credentialfortrust: challenge.protectionspace.servertrust]                   forauthenticationchallenge: challenge];         }         else if(the os trusts cert on server)         {              [challenge.sender usecredential:                  [nsurlcredential credentialfortrust: challenge.protectionspace.servertrust]                       forauthenticationchallenge: challenge];         }         else{... 

thanks guys!

so spent few days researching this. looks while nsurlconnection api cannot determine if certificate trusted, there's method in security framework handels that. here's code came with:

-(void)connection:(nsurlconnection *)connection didreceiveauthenticationchallenge:(nsurlauthenticationchallenge *)challenge {         if ([challenge previousfailurecount] > 0) {         [[challenge sender] cancelauthenticationchallenge:challenge];         nslog(@"bad username or password");         badusernameandpassword = yes;         finished = yes;         return;     }      if ([challenge.protectionspace.authenticationmethod isequaltostring:nsurlauthenticationmethodservertrust])     {          sectrustresulttype result;         //this takes servertrust object , checkes against keychain         sectrustevaluate(challenge.protectionspace.servertrust, &result);          if (appdelegate._allowinvalidcert)         {             [challenge.sender usecredential:              [nsurlcredential credentialfortrust: challenge.protectionspace.servertrust]                   forauthenticationchallenge: challenge];         }         //when testing against trusted server got ksectrustresultunspecified every time. other 2 match description of trusted server         else if(result == ksectrustresultproceed || result == ksectrustresultconfirm ||  result == ksectrustresultunspecified){             [challenge.sender usecredential:              [nsurlcredential credentialfortrust: challenge.protectionspace.servertrust]                   forauthenticationchallenge: challenge];         }         else         {             //asks user trust             trustgenerator *tg = [[trustgenerator alloc] init];              if ([tg gettrust:challenge.protectionspace])             {                  //may need add method add servertrust keychain firefox's "add excpetion"                 [challenge.sender usecredential:                  [nsurlcredential credentialfortrust: challenge.protectionspace.servertrust]                       forauthenticationchallenge: challenge];             }             else {                 [[challenge sender] cancelauthenticationchallenge:challenge];             }         }     }     else if ([[challenge protectionspace] authenticationmethod] == nsurlauthenticationmethoddefault) {         nsurlcredential *newcredential = [nsurlcredential credentialwithuser:_username password:_password persistence:nsurlcredentialpersistencenone];         [[challenge sender] usecredential:newcredential forauthenticationchallenge:challenge];     } }