CODEWITHSUNDEEP
ioscordovaself-signed
Dunken
Dunken

Reputation: 8681

Self-signed certificates on iOS

https://cordova.apache.org/docs/en/8.x/guide/appdev/security/index.html mentions that

The reason is that accepting self-signed certificates bypasses the certificate chain validation, which allows any server certificate to be considered valid by the device.

Upvotes: 3

Views: 1977

Answers (2)

jcesarmobile
jcesarmobile

Reputation: 53301

When using Cordova on iOS, if you want to use self signed certificates you have to add this code to your app.

@implementation NSURLRequest(DataController) + (BOOL)allowsAnyHTTPSCertificateForHost:(NSString *)host { return YES; } @end

So that's probably what this means

The reason is that accepting self-signed certificates bypasses the certificate chain validation, which allows any server certificate to be considered valid by the device.

Unlike Android, this is an all or nothing, once you add that all the validations are skipped.

Adding that only affects your app, not other apps, but it affects all the connections your WebView does. So it makes your app highly insecure as people could easily do man in the middle attacks.

Upvotes: 1

HAK
HAK

Reputation: 2071

SSL is installed on the server. So this is about an SSL certificate that is not issued by some CA(Certification Authority). A proper certificate is the one that is issued from some authentic CA like Verisign so that it can be validated by the Android or iOS device by verifying the chain of trust.

This doesn't involve any certificate installed on the mobile device itself, either iOS or Android.

For further clarification between self-signed certificate and a ca certificate check this SO answer.

Upvotes: 0

Related Questions