SSL error on download, Sierra only

Question

Created Jul ’21

Replies 2

Boosts 0

Views 1.3k

Participants 1

I have an app that uses NSURLDownload to download some files. I get an SSL error when running on Sierra (macOS 10.12), but it works fine on El Capitan (10.11) and High Sierra (10.13) and later. Safari has no problem downloading the same file on Sierra. Logging the NSError from the download:didFailWithError: delegate method shows:

Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSURLErrorFailingURLPeerTrustErrorKey=<SecTrustRef: 0x7f9620045950>, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9802, NSErrorPeerCertificateChainKey=(

"<cert(0x7f961f14ce00) s: files.frameforge.com i: R3>",

"<cert(0x7f961f12bc00) s: R3 i: ISRG Root X1>",

"<cert(0x7f961f12c400) s: ISRG Root X1 i: DST Root CA X3>"

), NSUnderlyingError=0x7f961e4af1a0 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSErrorFailingURLStringKey=https://files.frameforge.com/webgrab/mac/ff4.0-mac-update-list.xml.wgz, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFNetworkCFStreamSSLErrorOriginalValue=-9802, kCFStreamPropertySSLPeerCertificates=(

"<cert(0x7f961f14ce00) s: files.frameforge.com i: R3>",

"<cert(0x7f961f12bc00) s: R3 i: ISRG Root X1>",

"<cert(0x7f961f12c400) s: ISRG Root X1 i: DST Root CA X3>"

), _kCFStreamPropertySSLClientCertificateState=0, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x7f9620045950>, NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., _kCFStreamErrorDomainKey=3, NSErrorFailingURLKey=https://files.frameforge.com/webgrab/mac/ff4.0-mac-update-list.xml.wgz, _kCFStreamErrorCodeKey=-9802}}, NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., NSErrorFailingURLKey=https://files.frameforge.com/webgrab/mac/ff4.0-mac-update-list.xml.wgz, NSErrorFailingURLStringKey=https://files.frameforge.com/webgrab/mac/ff4.0-mac-update-list.xml.wgz, NSErrorClientCertificateStateKey=0}

Any idea how I could fix this? Regarding the recovery suggestion "Would you like to connect to the server anyway?", how would I do that, use an http URL?

Boost

Answer 1

JWWalker OP

Jul ’21

I found a workaround, though it's not ideal: Add an NSAppTransportSecurity exception in my Info.plist, allowing insecure loads for the domain I'm downloading from.

0

Answer 2

JWWalker OP

Jul ’21

I found the page Identifying the Source of Blocked Connections about checking ATS problems with nscurl, and that shows the same errors in Sierra, without allowing insecure loads. So I guess that means it's not an error in my code. And on Big Sur, all the nscurl --ats-diagnostics tests pass, so it seems like it's not a server problem either, leaving the conclusion that it must be a Sierra bug.

0