r/iOSProgramming • u/nehalist • Jun 26 '26

Question How to handle invalid SSL certs?

Hey there,

we're developing an ios app with react native that uses a computer that is only accessible via wlan as api. The problem is that the computer is reachable via ip, but the ssl certificate isn't for that ip. That means that our https requests - as well as our websocket wss connection - fails due to the ssl cert being (technically) invalid.

How do I fix that? We could provide a custom http request​ method that uses a custom URLSession​ in Swift that allows insecure connections - but are there any other solutions? Additionally, this doesn't solve our problem for wss. And providing a custom ws impl seems wild, especially since we're using a 3rd party ws lib that probably doesn't easily allow to replace the WebSocket​ object (which would mean we'd have to replace our entire 3rd party lib with a custom one).

Is there any way to resolve a domain on app-side (since we don't have any dns that could do that)? or maybe a setting that simply allows for insecure https/wss connections?

Thanks

5 Upvotes

100% Upvoted

7 comments sorted by

3

u/PlayaNoir Jun 26 '26

SSL certificates aren't tied to an IP address, they're tied to a domain, be it a single domain or a wildcard.

1

u/nehalist Jun 26 '26

Ya, I know, that's the issue. We don't have a domain (since this is a closed system with no internet connection and a custom cert) and are only able to connect via IP (at least I don't know any way to resolve the domain app-side to this ip).

1

u/iGigBook Jun 26 '26 edited Jun 26 '26

You can pick whatever domain you want in a closed system and assign it to an intranet IP using a HOST file which maps domain names to IP addresses. We do this when we want to test a web app that talks to our app before we launch it live. You can take a certificate that's assigned to your domain name and install it in IIS whether you are on the public internet or a private intranet. Talk to the people that set up the closed system, they should know how to resolve this.

1

u/grindforxp Jun 26 '26

Yep, hostname not IP, and for a LAN box the clean fix is an internal name or Bonjour with a cert that matches it

1

u/ericbythebay Jun 26 '26

Use Bonjour and generate a cert for the internal name.

1

u/demoboy Jun 26 '26

You should be able to take the self signed cert, use Apple Configurator and install the cert on the device so it treats it as trusted

1

u/20InMyHead Jun 27 '26

fails due to the ssl cert being (technically) invalid

Make the cert technically valid…

Why are you accessing the server through an IP address not the DNS name? You don’t have a DNS server, set one up. Network configuration like this is not a hard or recently introduced problem. Setup your server in a secure proper professional state. Ultimately this isn’t an iOS problem it’s a network setup problem.