如何防止我的应用在iOS 8上从TLSv1.2降级？

Question

I am trying to restrict my app from communicating with a server that is running any version of TLS prior to 1.2. From the docs, it appears that I should be able to do this by calling SSLSetProtocolVersionMin , so I have done that:

SSLContextRef context = SSLCreateContext(NULL, kSSLClientSide, kSSLStreamType);
SSLSetProtocolVersionMax(context, kTLSProtocol12);
SSLSetProtocolVersionMin(context, kTLSProtocol12);

I have verified that the call to SSLSetProtocolVersionMin does not return an error, but I am still able to connect to servers that negotiate down to SSLv3.

SSLSetProtocolVersionMax appears to work correctly, as when I set it to TLSv1.1 and the server to TLSv1.2 only, I cannot connect to the server.

It appears that this works as expected on iOS 9. Does anybody know if this is not supported in iOS 8, or if there are other steps I need to take?

Answer 1

You can configure iOS to only connect to servers meeting a minimum TLS version using Apple's new Application Transport Security in iOS 9.

You can add code like the following to your Info.plist file:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>mydomain.com</key>
        <dict>
            <key>NSThirdPartyExceptionMinimumTLSVersion</key>
            <string>1.2<string/>
        </dict>
    </dict>
</dict>

You can take a look at the WWDC video .

EDIT:

I see you added to your question to state that you need to accomplish this on iOS 8, which does not have ATS. But hopefully this answer will help those using iOS 9 and that need to do this, since the original question did not include this limitation.