How to disable SSL 2.0 on iOS?

1
votes

Currently the app I'm working on uses NSURLConnection to connect to the server using HTTPS. The requirement is to enforce the prevention of connections using SSL 2.0 and to use only SSL 3.0 or TLS for connections. What should be done to disable SSL 2.0 support in the app? As far as i see lower level CFNetwork or Secure Transport API provide some control over SSL protocol, but should all the current NSURL* networking code be changed in order to do this?

1
iosobjective-csslhttps

1 Answers

2
votes

As far as I know, you cannot achieve this with NSURLConnection.

However, NSURLSession provides APIs to configure a session via a NSULRSessionConfiguration and TLSMaximumSupportedProtocol and TLSMinimumSupportedProtocol.

Switching from NSURLConnection to NSULRSession/NSURLSessionTask should be straight forward.