ios - 在 iOS 8 中下载时出现 kCFStreamErrorDomainSSL 错误

Question

我尝试在 Swift 中使用 NSURLSessionDownloadDelegate 下载文件。但是当我调用下载方法时，它经常显示以下错误。

Error Domain=NSURLErrorDomain Code=-1202 "The operation couldn’t be completed. (NSURLErrorDomain error -1202.)" UserInfo=0x7fbac2dd2f60 {NSErrorFailingURLStringKey=https://dl.dropboxusercontent.com/content_link/EvFVp1WYxrW15Vy6kfUGIChdHy4HVhatT0p6iQhhG24wzNsQ48CEDs0shjmTbCWb/file?dl=1, NSErrorFailingURLKey=https://dl.dropboxusercontent.com/content_link/EvFVp1WYxrW15Vy6kfUGIChdHy4HVhatT0p6iQhhG24wzNsQ48CEDs0shjmTbCWb/file?dl=1, NSURLErrorFailingURLPeerTrustErrorKey=, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9813, NSUnderlyingError=0x7fbac2ca07e0 "The operation couldn’t be completed. (kCFErrorDomainCFNetwork error -1202.)"}

我尝试编辑 info.plist 但它不起作用。

Answer 1

您是否为 ATS(Apple 传输安全)添加了任意负载，例如:

<key>NSAppTransportSecurity</key>
    <dict>
        <key>NSAllowsArbitraryLoads</key>
        <true/>
    </dict>

请注意，这是不安全的，您可能需要按域自定义 ATS 规则，例如:

<key>NSAppTransportSecurity</key>
    <dict>
        <key>NSExceptionDomains</key>
        <dict>
            <key>dl.dropboxusercontent.com</key>
            <dict>
                <key>NSIncludesSubdomains</key>
                <true/>
                <key>NSExceptionRequiresForwardSecrecy</key>
                <false/>
            </dict>
        </dict>
    </dict>

[更新]如果我们仔细观察错误，我们就能看到关键

NSURLErrorFailingURLPeerTrustErrorKey

那么 Apple 关于 HTTPS Server Trust Evaluation 的技术说明可能会有所帮助。浏览我们阅读的文档

Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “example.com” which could put your confidential information at risk." UserInfo=0x14a730 {NSErrorFailingURLStringKey=https://example.com/, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, NSErrorFailingURLKey=https://example.com/, NSLocalizedDescription=The certificate for this server is invalid. You might be connecting to a server that is pretending to be “example.com” which could put your confidential information at risk., NSUnderlyingError=0x14a6c0 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “example.com” which could put your confidential information at risk.", NSURLErrorFailingURLPeerTrustErrorKey=}

嗯，就是这样，因为 NSURLErrorDomain 域中的错误 -1202 是 NSURLErrorServerCertificateUntrusted，这是由于 TSL 可能存在问题造成的。

所以我们此时需要检查 TSL:

我们通过 CLI 检查证书:

$ openssl s_client -showcerts -host dl.dropboxusercontent.com -port 443
CONNECTED(00000003)
depth=2 /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/OU=Domain Control Validated/CN=dl.dropboxusercontent.com
   i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
---
Server certificate
subject=/OU=Domain Control Validated/CN=dl.dropboxusercontent.com
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2
---
No client certificate CA names sent
---
SSL handshake has read 4569 bytes and written 456 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 50414926328455F36215516BEB0C40F1DD512C3C0989E0C090DC9277E754B35EFF0CE3AEA4D3FB524FFE071BE2D4426C
    Key-Arg   : None
    Start Time: 1447281208
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
closed

我们可以在这里看到该域支持TLSv1/SSLv3，

我们可以使用 SSL 质量实验室的 SSL 服务器测试在线完成此操作，并获得相同的良好结果 here 。

我想知道这个问题是否与 A couple users getting NSURLErrorServerCertificateUntrusted 重复但通过上面的 TSL 检查，我们可以清楚地看到有问题的域没有问题。

所以(简单)问题

您的手机时间和日期正确吗？