Understanding CFNetwork SSLHandshake Failure in iOS 9

When developing applications for iOS, networking is a fundamental aspect that developers must handle efficiently. One of the crucial elements of secure networking is the establishment of a Secure Sockets Layer (SSL) handshake. This article explores the concept of `CFNetwork SSLHandshake failed` errors that developers may encounter in iOS 9. We'll address the causes, implications, and possible solutions to these failures.

What is CFNetwork?

CFNetwork is a low-level, peer-to-peer abstraction layer for network protocols that manages and simplifies network programming in iOS and macOS. It provides a suite of classes that facilitate dealing with various network communication protocols, thereby abstracting complex interactions.

The SSL Handshake

SSL (Secure Sockets Layer) is a standard security protocol that establishes encrypted links between a web server and a browser in online communication. The SSL Handshake is an initiation step taken when a client and server communicate securely:

1. ClientHello: The client sends a "Hello" message that includes supported SSL versions and cipher suites.
2. ServerHello: The server responds with selected SSL version, a cipher suite, and its public certificate.
3. Key Exchange: The client generates a premaster secret using the server’s public key.
4. Session Key Generation: Both parties generate session keys for encryption and decryption.
5. Finished Messages: Both client and server exchange finished messages; secure communication begins after validation.

Origin of SSL Handshake Failures in iOS 9

SSL handshake failures can manifest due to numerous issues. Some of the most notable are:

• Certificate Validation Failures: If the server's SSL certificate is not trusted by iOS or is configured incorrectly, the handshake will fail.
• Incorrect Cipher Suites: The server might not support the ciphers that the iOS 9 device supports. Bulking operations might be incompatible.
• TLS Version Mismatch: iOS 9 supports TLS 1.2 and earlier. A server demanding TLS 1.3 will cause handshake problems.
• Network Interception: Firewalls or proxies intercepting the network might alter the handshake packets.
• Expired Certificates: An expired server certificate halts the handshake immediately.

Analyzing CFNetwork SSLHandshake Failed Logs

Developers see CFNetwork handshake failures expressed in logs as:

• Certificate Chains: Ensure that the necessary intermediary certificates are installed on your server. The entire trust chain must be valid.
• Review Cipher Suites: Verify that the server supports a cipher suite that iOS 9 devices can use. OpenSSL's `s_client` tool is handy for checking supported suites.
• SSL/TLS Version Support: Ensure the server supports TLS 1.2 or 1.1 for compatibility with iOS 9.
• Date and Time Settings: Check iOS device date and time settings. Validation might fail due to incorrect device time.