title: AFNetworking problems with TLS Verification of a self signed server root CA
body: <p>This is a question that tries to both find solutions for my particular use case, and to document what I've tried to do for anyone else who is following this process.</p>
  
  <p>We have a RESTful server and an iOS app. We have our own certificate authority and the server has a root certificate authority and a self signed certificate. We followed this process to generate the following files:</p>
  
  <p><a href="http://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/">http://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/</a></p>
  
  <p>rootCA.pem
  rootCA.key
  server.crt
  server.key</p>
  
  <p>Only the server certificates are stored on our server, and as part of the SSL process the public keys are sent with the API calls for verification.</p>
  
  <p>I've followed this process to use AFNetworking to use certificate pinning as well as public key pinning to verify our self signed certificates:</p>
  
  <p><a href="http://initwithfunk.com/blog/2014/03/12/afnetworking-ssl-pinning-with-self-signed-certificates/">http://initwithfunk.com/blog/2014/03/12/afnetworking-ssl-pinning-with-self-signed-certificates/</a></p>
  
  <p>We convert the .crt file to a .cer file (in DER format) according to this guide:</p>
  
  <p><a href="https://support.ssl.com/Knowledgebase/Article/View/19/0/der-vs-crt-vs-cer-vs-pem-certificates-and-how-to-convert-them">https://support.ssl.com/Knowledgebase/Article/View/19/0/der-vs-crt-vs-cer-vs-pem-certificates-and-how-to-convert-them</a></p>
  
  <p>and include the .cer file (server.cer) in the iOS app bundle. This successfully allows our app to make GET/POST requests to our server. However, because our server certificate might expire or get reissued, we want to instead use the root CA, as done by people in this thread on AFNetworking:</p>
  
  <p><a href="https://github.com/AFNetworking/AFNetworking/issues/1944">https://github.com/AFNetworking/AFNetworking/issues/1944</a></p>
  
  <p>Currently we've updated to AFNetworking 2.6.0 so our networking libraries should definitely include all the updates, include ones in this discussion:</p>
  
  <p><a href="https://github.com/AFNetworking/AFNetworking/issues/2744">https://github.com/AFNetworking/AFNetworking/issues/2744</a></p>
  
  <p>The code used to create our security policy:</p>
  
  <pre><code>    var manager: AFHTTPRequestOperationManager = AFHTTPRequestOperationManager()
      manager.requestSerializer = AFJSONRequestSerializer() // force serializer to use JSON encoding
  
      let policy: AFSecurityPolicy = AFSecurityPolicy(pinningMode: AFSSLPinningMode.PublicKey)
      var data: [NSData] = [NSData]()
      for name: String in ["rootCA", "server"] {
          let path: String? = NSBundle.mainBundle().pathForResource(name, ofType: "cer")
          let keyData: NSData = NSData(contentsOfFile: path!)!
          data.append(keyData)
      }
      policy.pinnedCertificates = data
      policy.allowInvalidCertificates = true 
      policy.validatesDomainName = false 
      manager.securityPolicy = policy
  </code></pre>
  
  <p>With server.cer included, we're able to trust our server by pinning the public key (also tried AFSecurityPolicyPinningMode.Certificate); this worked because the exact certificate is included. However because we might change up the server.crt file that the server has, so we want to be able to do it with just rootCA.cer.</p>
  
  <p>However, with just the rootCA included in the app bundle, this doesn't seem to work. Is it that the rootCA doesn't have enough information about the public key to verify the server certificate, which was signed with the root CA? The server.crt file may also have a changing CommonName.</p>
  
  <p>Also, since my fluency in SSL terminology is pretty raw, if anyone has can clarify whether I'm asking the correct questions, that would be great. The specific questions are:</p>
  
  <ol>
  <li>Am I generating the certificates correctly so that the server can prove its identity using the self signed server.crt file?</li>
  <li>Is it possible to include only the rootCA.cer file into the bundle and be able to verify the leaf certificate server.crt? Will it be able to verify another server2.crt file signed by the same rootCA? Or should we include an intermediate cert between the rootCA and the leaf?</li>
  <li>Is public key pinning or certificate pinning the right solution for this? Every forum and blog post I've read says yes, but even with the most updated AFNetworking library we haven't had any luck.</li>
  <li>Does the server need to somehow send both the server.crt and the roomCA.pem signatures over?</li>
  </ol>