title: iOS 11: ATS (App Transport Security) no longer accepts custom anchor certs?
body: <p>I am leasing a self signed certificate using <code>NSMutableURLRequest</code> and when the certificate is anchored using a custom certificate with <code>SecTrustSetAnchorCertificates</code> <code>IOS 11</code> fails with the following error message:</p>
  <pre><code>refreshPreferences: HangTracerEnabled: 1
  refreshPreferences: HangTracerDuration: 500
  refreshPreferences: ActivationLoggingEnabled: 0 ActivationLoggingTaskedOffByDA:0
  ATS failed system trust
  System Trust failed for [1:0x1c417dc40]
  TIC SSL Trust Error [1:0x1c417dc40]: 3:0
  NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)
  Task &lt;721D712D-FDBD-4F52-8C9F-EEEA28104E73&gt;.&lt;1&gt; HTTP load failed (error code: -1200 [3:-9802])
  Task &lt;721D712D-FDBD-4F52-8C9F-EEEA28104E73&gt;.&lt;1&gt; finished with error - code: -1200
  </code></pre>
  <p>What used to work for <code>IOS 10</code> no longer works in <code>IOS 11</code>.</p>
  <p>I am aware that <code>IOS 11</code> no longer supports the following:</p>
  <ul>
  <li>RC4 3DES-CBC AES-CBC</li>
  <li>MD5 SHA-1</li>
  <li>&lt;2048-bit RSA Pub Keys - All TLS connections to servers</li>
  <li>http://</li>
  <li>SSLv3</li>
  <li>TLS 1.0</li>
  <li>TLS 1.1</li>
  </ul>
  <p>And the certificate does not use these except for one fingerprint, which is <code>SHA-1</code>, but a <code>SHA-256</code> fingerprint is also listed.</p>
  <p>And by adding the following we can bypass the ATS (App Transport Security) error:</p>
  <pre><code>&lt;key&gt;NSAppTransportSecurity&lt;/key&gt;
  &lt;dict&gt;
          &lt;key&gt;NSExceptionDomains&lt;/key&gt;
          &lt;dict&gt;
              &lt;key&gt;mydomain.example&lt;/key&gt;
              &lt;dict&gt;
                  &lt;!--Include to allow subdomains--&gt;
                  &lt;key&gt;NSIncludesSubdomains&lt;/key&gt;
                  &lt;true/&gt;
                  &lt;key&gt;NSExceptionRequiresForwardSecrecy&lt;/key&gt;
                  &lt;false/&gt;
              &lt;/dict&gt;
          &lt;/dict&gt;
  &lt;/dict&gt;
  </code></pre>
  <p>By installing the root / anchor certificate onto the phone itself also works without the need to whitelist the <code>mydomain.example</code>.</p>
  <p>Does this mean that ATS no longer supports self-signed certificates?</p>
  <p>The following worked in <code>IOS 10</code>:</p>
  <pre><code>SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)certs);
  </code></pre>
  <p>Using <code>nscurl</code> on a Mac shows many failures, and after installing the root certificate into the &quot;System&quot; Keystore, <code>nscurl</code> succeeds.
  I did this on <code>macOS 10.12.6</code>.</p>
  <pre><code>nscurl --verbose --ats-diagnostics https://
  </code></pre>
  <p>How can I make this work with a custom certificate, but without the need to install certificates or whitelist the domain?</p>