Bypassing App Transport Security to allow unsecured HTTP server
<h2>Situation:</h2>

<p>I have to connect to these two different servers for development and staging use. Both of the servers have unstrusted SSL certificates.
For example purposes, these two servers URL's are:</p>

<p>Staging server: <code>https://52.70.13.2:1010/</code></p>

<p>Development server: <code>https://example.entrydns.org:1012</code></p>

<p>Whenever I tried to call the API, i get empty response with following error:</p>

<pre><code>NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)
</code></pre>

<p>or sometimes,</p>

<pre><code>NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)
</code></pre>

<p>I use <a href="https://github.com/Moya/Moya" rel="nofollow noreferrer">Moya</a> for my network layers, which is basically just a nice wrapper for <a href="https://github.com/Alamofire/Alamofire" rel="nofollow noreferrer">Alamofire</a>. For additional info, I use <code>XCode 7.3</code> and the app only supports <code>&gt; iOS 9</code>.</p>

<h2>What I've did:</h2>

<p>I am very well aware of App Transport Security issue that Apple want to enforce. I wanted to disable it for development but still in vain. Some of the ways I tried to bypass the ATS it are as the following:</p>

<ol>
<li><p>Add the following in my <code>plist</code> to allow arbitrary loads.</p>

<pre><code>&lt;key&gt;NSAppTransportSecurity&lt;/key&gt;
&lt;dict&gt;
    &lt;key&gt;NSAllowsArbitraryLoads&lt;/key&gt;
    &lt;true/&gt;
&lt;/dict&gt;
</code></pre></li>
<li><p>Explicitly defines the domain exceptions.</p>

<pre><code>&lt;key&gt;NSAppTransportSecurity&lt;/key&gt;
&lt;dict&gt;
    &lt;key&gt;NSExceptionDomains&lt;/key&gt;
    &lt;dict&gt;
        &lt;key&gt;example.entrydns.org&lt;/key&gt;
        &lt;dict&gt;
            &lt;key&gt;NSIncludesSubdomains&lt;/key&gt;
            &lt;true/&gt;
            &lt;key&gt;NSExceptionAllowsInsecureHTTPLoads&lt;/key&gt;
            &lt;true/&gt;
            &lt;key&gt;NSExceptionRequiresForwardSecrecy&lt;/key&gt;
            &lt;true/&gt;
            &lt;key&gt;NSExceptionMinimumTLSVersion&lt;/key&gt;
            &lt;string&gt;TLSv1.1&lt;/string&gt;
            &lt;key&gt;NSThirdPartyExceptionAllowsInsecureHTTPLoads&lt;/key&gt;
            &lt;false/&gt;
            &lt;key&gt;NSThirdPartyExceptionRequiresForwardSecrecy&lt;/key&gt;
            &lt;true/&gt;
            &lt;key&gt;NSThirdPartyExceptionMinimumTLSVersion&lt;/key&gt;
            &lt;string&gt;TLSv1.1&lt;/string&gt;
            &lt;key&gt;NSRequiresCertificateTransparency&lt;/key&gt;
            &lt;false/&gt;
        &lt;/dict&gt;
    &lt;/dict&gt;
&lt;/dict&gt;
</code></pre></li>
</ol>

<p>Here's the screenshot for my <code>plist</code>:
<a href="https://i.stack.imgur.com/oGjc5.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/oGjc5.png" alt="enter image description here"></a></p>

<ol start="3">
<li><p>I also tried to disable the Server Trust Policy of Alamofire manager shared instance. Here's the example code:</p>

<pre><code>// Disable Policies
let policies: [String: ServerTrustPolicy] = [
    "https://example.entrydns.org:1012/": .DisableEvaluation,
    "https://52.70.13.2:1010/": .DisableEvaluation
]

let manager = Manager(
    configuration: NSURLSessionConfiguration.defaultSessionConfiguration(),
    serverTrustPolicyManager: ServerTrustPolicyManager(policies: policies)
)
 // ---------------
let networkLogger = NetworkLoggerPlugin(verbose: true, responseDataFormatter: nil)

let endpointClosure = { (target: ExampleAPI) -&gt; Endpoint&lt;ExampleAPI&gt; in      
    let url = target.baseURL.URLByAppendingPathComponent(target.path).absoluteString
    let endpoint: Endpoint&lt;ExampleAPI&gt; = Endpoint&lt;ExampleAPI&gt;
            (URL: url,
             sampleResponseClosure: {.NetworkResponse(200, target.sampleData)},
             method: target.method,
             parameters: target.parameters,
             parameterEncoding: .URLEncodedInURL)
    return endpoint.endpointByAddingHTTPHeaderFields(target.header())
}

let ExampleProvider = MoyaProvider&lt;ExampleAPI&gt;(manager: manager,
                                       plugins:[networkLogger],
                                       endpointClosure: endpointClosure)
</code></pre></li>
<li><p>Open the URLs and download the certs on my device and simulators.</p></li>
</ol>

<p>Even after all the steps above I still got the same error. Any takes on what I did wrong and what I can do to solve this problem? BTW, it would be great if I can avoid server-side solution.</p>

<p>Thanks in advance. </p>

<h3>References:</h3>

<ul>
<li><a href="https://ste.vn/2015/06/10/configuring-app-transport-security-ios-9-osx-10-11/" rel="nofollow noreferrer">https://ste.vn/2015/06/10/configuring-app-transport-security-ios-9-osx-10-11/</a></li>
</ul>