NSURLConnection: Use all CA certificates installed on device - ios

Question

I want to access some web ressources using HTTPS in a custom iOS 6 app. Some target servers are using a certificate which is signed by a CA that is not by default included in iOS, but was manually added to the keychain of the device. Therefore all URLs can be opened in Safari without any warning or error.
What I want to achieve is the same behavior as Safari: I want to load the websites if Safari would have trusted them, or deny to load them in case of any error. As the installed certificates can change from case to case I do not want to manually include any certificates in the application ressources, which is what many questions here at SO are about.
My problem is that I do not get SecTrustEvaluate to return kSecTrustResultProceed. Do you have any idea what I can do?
If my canAuthenticateAgainstProtectionSpace returns NO, iOS handles the server certificate check on itself, but it does not seem to check for additionally installed certificates (as Safari does).
Here is some code to try and understand what I got so far:
- (void)viewDidLoad
{
[super viewDidLoad];
[self loadURLWithString:#"https://myserver.com"];
}
+ (BOOL) isChallenge: (NSURLAuthenticationChallenge*) challenge validForConnection: (NSURLConnection*)conn{
SecTrustRef serverTrust=[[challenge protectionSpace] serverTrust];
//Some magic here?
// Check Server Certificate
SecTrustResultType evalResult;
if(SecTrustEvaluate(serverTrust,&evalResult) != errSecSuccess){
NSLog(#"Call to SecTrustEvaluate failed");
return NO;
}
if(evalResult != kSecTrustResultProceed){
NSLog(#"Server certificate invalid");
return NO;
}
NSLog(#"Server certificate valid");
return YES;
}
- (void)loadURLWithString: (NSString*)str{
NSURLConnection *conn =
[NSURLConnection connectionWithRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:str]] delegate:self];
[conn start];
}
- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge{
if([[self class] isChallenge:challenge validForConnection:connection])
[challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
else
[challenge.sender cancelAuthenticationChallenge:challenge];
}
- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace{
return [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust];
}
- (void)connection:(NSURLConnection *)connection didFailWithError:(NSError *)error{
NSLog(#"Failed with error: %#",error);
}
- (void)connectionDidFinishLoading:(NSURLConnection *)connection{
NSLog(#"loading complete");
}
- (void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)response{
}
- (void)connection:(NSURLConnection *)connection didReceiveData:(NSData *)data{
}

Answer 1

What you're trying to do is not permitted. For more info, see this thread in the Apple developer forums:
https://devforums.apple.com/message/660579#660579