https连接中的NSURLSession/NSURLConnection HTTP加载失败(kCFStreamErrorDomainSSL,-9802)错误

Question

在iOS 9中,我使用基本的NSURLConnection命令使用网址https://s3.amazonaws.com/furniture.retailcatalog.us/products/2061/6262u9665.jpg.

NSOperationQueue *completionQueue = [NSOperationQueue mainQueue];
    NSURLSessionConfiguration *configuration = [NSURLSessionConfiguration defaultSessionConfiguration];
    self.mURLSession = [NSURLSession sessionWithConfiguration:configuration delegate:nil delegateQueue:completionQueue];

    NSURLRequest *request = [NSURLRequest requestWithURL:[NSURL URLWithString:@"https://s3.amazonaws.com/furniture.retailcatalog.us/products/2061/6262u9665.jpg"]];
    NSURLSessionDataTask *dataTask = [self.mURLSession dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
        NSLog(@"%@",error);
    }];
    [dataTask resume];

但得到这个错误

错误域= NSURLErrorDomain代码= -1200"发生SSL错误,无法与服务器建立安全连接." UserInfo = {NSLocalizedDescription =发生了SSL错误并且无法与服务器建立安全连接.,NSLocalizedRecoverySuggestion =您是否还要连接到服务器？,_kCFStreamErrorDomainKey = 3,NSUnderlyingError = 0x7c1075e0 {错误域= kCFErrorDomainCFNetwork代码= - 1200"(null)"UserInfo = {_ kCFStreamPropertySSLClientCertificateState = 0,_kCFNetworkCFStreamSSLErrorOriginalValue = -9802,_kCFStreamErrorCodeKey = -9802,_kCFStreamErrorDomainKey = 3,kCFStreamPropertySSLPeerTrust =,kCFStreamPropertySSLPeerCertificates = {type = immutable,count = 3,values =(0:1:2: }}}},_ kCFStreamErrorCodeKey = -9802,NSErrorFailingURLStringKey =https://s3.amazonaws.com/furniture.retailcatalog.us/products/2061/6262u9665.jpg,NSErrorPeerCertificateChainKey = {type = immutable,count = 3,values =(0:1:2 :)),NSErrorClientCertificateStateKey = 0 ,NSURLErrorFailingURLPeerTrustErrorKey =,NSErrorFailingURLKey = https://s3.amazonaws.com/furniture.retailcatalog.us/products/2061/6262u9665.jpg }

即使这是https连接,为什么我会收到这个奇怪的错误.任何人都可以让我知道.

Answer 1

根据Apple 技术说明,App Transport Security需要SHA-2.S3(和CloudFront)证书使用SHA-1,这就是发生此故障的原因.

解决方法是将to设置NSExceptionRequiresForwardSecrecy为false.(这是在AWS转移到SHA-2之前(到2015年9月30日)).

Answer 2

我也遇到过这个问题.不幸的是,我无法告诉你为什么会这样--S3似乎符合前方保密要求(至少根据这个答案):

Adams-MacBook-Pro:tmp Adam$ curl -kvI https://s3.amazonaws.com
* Rebuilt URL to: https://s3.amazonaws.com/
*   Trying 54.231.32.128...
* Connected to s3.amazonaws.com (54.231.32.128) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

我在这里找到的解决方法是在应用程序的Info.plist文件中添加一个例外,不需要保密:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>s3.amazonaws.com</key>
        <dict>
            <key>NSExceptionRequiresForwardSecrecy</key>
            <false/>
        </dict>
    </dict>
</dict>

据我所知,这是您可以降低内置安全性以连接到Amazon S3的最低金额.