@Matt:
I was able to produce a failing connection (wrong SPKI-SHA256-BASE64) with a certificate error trying to load https://apple.com. But downloading https://www.apple.com still works – even though NSIncludesSubdomains is true.
Testing more, I found that some subdomains are pinned correctly, some are not. This is also the case for the sub domains I was originally trying to pin in my project.
Info.plist section:
<key>NSAppTransportSecurity</key>
<dict>
<key>NSPinnedDomains</key>
<dict>
<key>apple.com</key>
<dict>
<key>NSIncludesSubdomains</key>
<true/>
<key>NSPinnedCAIdentities</key>
<array>
<dict>
<key>SPKI-SHA256-BASE64</key>
<string>r/333mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=</string>
</dict>
</array>
</dict>
</dict>
</dict>
Code:
class ViewController: UIViewController
{
		
		private lazy var urlSession: URLSession =
		{
				URLSession(configuration: URLSessionConfiguration.default, delegate: nil, delegateQueue: .main)
		}()
		
		override func viewDidLoad()
		{
				super.viewDidLoad()
				
				[
						"apple.com",
						"www.apple.com",
						"images.apple.com",
						"store.apple.com",
				]
				.map { URL(string: "https://\($0)")! } /* intentional crash on failure */
				.forEach
				{ url in
						var urlRequest = URLRequest(url: url)
						urlRequest.httpMethod = "GET"
						let task = self.urlSession.dataTask(with: urlRequest)
						{ (data, response, error) in
								var text: String?
								if let data = data
								{
										text = String(data: data, encoding: .ascii)?
														.trimmingCharacters(in: .whitespacesAndNewlines)
								}
								
								let result = "\(text ?? data?.debugDescription ?? error.debugDescription)".prefix(100)
								print("URL: \(url): result: \(result)")
						}
						
						task.resume()
				}
								
		}
		
}
Output (filtered)
URL: https://apple.com: result: Optional(Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You m
URL: https://images.apple.com: result: Optional(Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You m
URL: https://www.apple.com: result: <!DOCTYPE html>
URL: https://store.apple.com: result: Optional(Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You m
Thanks
Lars
