Thank you for the clarification. I had hoped, though, that there was a way to proceed (the certificate the SPKI fingerprint from the Info.plist belongs to may since have expired, but the app may have knowledge of the current certificate's SPKI hash).

@eskimo I am not really getting anywhere with this so far other than that I can confirm the problem still persists in yesterday's beta 7. Would it be helpful if I opened a DTS incident for this?

FWIW: If so, the next step is to confirm that the data and its signature made it to your server intact. On both the iOS and server side, generate an independent hash of the data and the signature and check that they match. Turns out this was the issue, the cause being the same as the one discussed in this thread. But thanks anyway.

This does not actually symbolicate the crash log for me. I filed FB13543963 about this.

FWIW, the resolution of the feedback I filed was basically "works as designed".

Thanks. Does that mean the example code if checkValidity(of: serverTrust) { let credential = URLCredential(trust: serverTrust) completionHandler(.useCredential, credential) } does not perform trust evaluation?

I see. However, doing this: Leave ATS enabled. Intercept the server trust authentication challenge (NSURLAuthenticationMethodServerTrust). Apply your extra checks. Complete the challenge with .performDefaultHandling. causes the trust evaluation to be performed after the extra checks, correct? What if I wanted to have the system check be done first - then I would to resort to calling SecTrustEvaluate myself?

Sure: I am required to implement HPKP (aka. Public Key Pinning Extension for HTTP) as defined in RFC 7469 which is not supported out of the box (cf. FB5986841). Additionally I have to secure the first-ever connection as well by supporting preloaded pins, but I cannot use Identity Pinning (cf. thread and FB12333846). So I have to build everything from scratch.

Thank you. It was not obvious (to me) that continuing with completionHandler(.useCredential, URLCredential(trust: serverTrust)) does not benefit from the OS performing trust evaluation.

Sorry, but I have another question: To do my own checks I need to call e.g. SecTrustCopyCertificateChain(_:) on the trust object. Is that API guaranteed to return the correct certificate chain if the trust object has not been evaluated?

I did just that: Calling SecTrustEvaluateAsyncWithError (on a background queue) myself before calling SecTrustCopyCertificateChain (on the main queue). The latter, however, lead to Xcode printing "This method should not be called on the main thread as it may lead to UI unresponsiveness." which apparently resulted from SecTrustCopyCertificateChain calling SecTrustEvaluateIfNecessary even though I had already done that. So I ended up calling SecTrustCopyCertificateChain on the background queue as well.

This seems to be the same problem addressed here, am I right?

Thanks Quinn, the latest beta 4 seems to have resolved this issue for the time being. I will keep an eye on the upcoming betas nevertheless and report back in case it happens again.

You mean via the NSFileProviderService? I was not aware that this uses XPC under the hood.

Hi Argun, thank you; indeed the error occurred while trying to read from a characteristic. Here is a snippet of the log: I just assumed that if 6 was CBATTErrorRequestNotSupported then 65535 would be kBluetoothSDPErrorCodeReservedEnd. However I was able to resolve the issue. I reviewed all the changes that happened since I had it working and as it turns out the instances' type I store details about the connection in got changed from a class to a struct. This change in semantics make it very likely that the connection got dropped while the read was in process. After I changed the type back to a class everything worked as it did before.