NSURLErrorServerCertificateUntrusted: iOS Fix

• Self-signed cert in dev without bundle trust
• App Transport Security (ATS) rejects TLS 1.0/1.1
• Cert missing SAN (Subject Alternative Name) — iOS requires since 2017
• CA not in iOS trust store (legacy Symantec roots retired)
• Incomplete cert chain (missing intermediate)

1. Use a real cert from a mainstream CA (Let's Encrypt, DigiCert, Sectigo)
2. Check chain: Enterno SSL Checker
3. For dev: pin cert in-app via NSURLSessionDelegate urlSession:didReceiveChallenge:
4. Info.plist: NSAppTransportSecurity > NSExceptionDomains for a specific domain (careful)
5. Server TLS config: TLS 1.2+ + ECDHE + SHA-256

Check SSL Certificate →

• ERR_SSL_PROTOCOL_ERROR
• NET::ERR_CERT_AUTHORITY_INVALID
• SSL Handshake Failed
• All SSL errors

NSURLErrorServerCertificateUntrusted (-1202) indicates that your iOS or macOS device does not trust the SSL certificate presented by a server. This can occur due to expired certificates, unrecognized Certificate Authorities (CAs), or mismatched domain names. To resolve this issue, verify the certificate chain, ensure it is correctly configured, and check for any certificate revocation status using tools like OpenSSL or your browser's developer tools.

The NSURLErrorServerCertificateUntrusted error occurs when an application on iOS or macOS attempts to establish a secure connection and the SSL certificate presented by the server cannot be verified as trustworthy. This verification process involves several steps, including checking the certificate's validity period, the CA that issued the certificate, and whether the domain name matches the certificate.

When a device encounters an untrusted certificate, it will typically display a warning to the user, indicating that the connection is not secure. This error can stem from various issues:

• Expired Certificates: If a certificate has passed its expiration date, it is considered invalid.
• Unrecognized Certificate Authorities: If the CA that issued the certificate is not included in the device's trusted root certificate store, the certificate will be deemed untrusted.
• Domain Mismatch: The domain name in the certificate must match the domain of the server being accessed. A mismatch will trigger the error.

To diagnose and resolve this issue, developers should use tools such as OpenSSL to inspect the certificate chain. The command openssl s_client -connect example.com:443 -showcerts can be executed in the terminal to view the certificate details and identify potential problems.

To resolve the NSURLErrorServerCertificateUntrusted (-1202) error, follow these steps:

1. Check Certificate Expiration: Use the OpenSSL command to check if the certificate is still valid. For example:

openssl s_client -connect example.com:443 -servername example.com

Inspect the output for the notAfter field to confirm the certificate's expiration date.

1. Verify Certificate Authority: Ensure that the CA of the certificate is recognized by your device. You can find the list of trusted CAs on the official Apple website or by comparing with the /etc/ssl/certs directory on macOS.
2. Domain Name Check: Make sure that the domain name in the SSL certificate matches the server’s domain. Mismatches can occur if the certificate is issued for a different domain or subdomain.
3. Use Certificate Pinning: In development environments, consider implementing SSL pinning to prevent this error. This involves including the public key or certificate hash in your app, ensuring it trusts only specific certificates.
4. Update Your Application's Trust Settings: If you're developing an app, ensure that your app's networking code correctly handles SSL errors. Implement delegate methods to allow for custom error handling, such as:

func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) { if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust { let serverTrust = challenge.protectionSpace.serverTrust if let serverTrust = serverTrust { completionHandler(.useCredential, URLCredential(trust: serverTrust)) } else { completionHandler(.performDefaultHandling, nil) } } }

By following these steps, you can effectively troubleshoot and resolve the NSURLErrorServerCertificateUntrusted (-1202) error, ensuring secure connections for your iOS or macOS applications.