maverick96
Lost but trying
Profile
Posts: 174
Reg: Jan 22, 2014
Orlando
3,390
08/28/16 06:36 AM (8 years ago)

App Transport Security

Ok, so updating my app and running into the ATS error. I've read about disabling this through .plist but I still wandering the issues down the road. I read that in 2017 it may be required on all apps? If I submitan update to my app now will it be functional in 2017? I have a RSS Feed, Chat, and Url links that won't function due to the ATS error.
 
SmugWimp
Smugger than thou...
Profile
Posts: 6316
Reg: Nov 07, 2012
Tamuning, GU
81,410
like
08/28/16 04:33 PM (8 years ago)
My 'Buzztouch server' is really just a subdirectory of my 'main' domain. And despite my 'main domain' site having SSL, my BT server is accessed from a 'subdomain' address that bypasses SSL. Thus, I also need to disable ATS to get my apps to work. But it won't stay that way forever. https://techcrunch.com/2016/06/14/apple-will-require-https-connections-for-ios-apps-by-the-end-of-2016/ So get used to the fact that soon your BT Server (and just about every other server connection) will require SSL in the future. You're either going to need to add an SSL Certificate to your BT Server, or arrange your directory structure and DNS so that your BT Server utilizes any existing SSL access available. This can either be via a purchased SSL Certificate for your domain, or by the use of 'Open SSL' to create your own SSL Cert. What is the difference between a 'Self Made' SSL Cert and a purchased one? Not much. The whole concept of SSL is based on 'Trust'. Do you trust the entity that created and released the SSL Cert? Companies (and there actually aren't 'that' many of them) go through serious hoops to have their systems 'certified' and have their cert authorities stored in your computer. What this does is add the issuers 'root certificate' in your computer root store. Certificates issued are 'descendants' of that Root Cert. And any website you visit (via HTTPS) that has an SSL cert that was created by a 'trusted issuer' will not set off any bells, whistles or alarms. But if you connect via HTTPS to a site that and get an alert, one of a few things is the issue: 1) The certificate expired. 2) You visited 'help.yourdomain.com' and the certificate is valid for 'www.yourdomain.com'. 3) The issuing entity is not in the root store. Companies pay a lot of money to get their systems certified as a trusted source. That's why SSL Certificates cost as much as they do. But other than a lot of due diligence to ensure that no one can access their 'root certificate server' (typically an air-gapped machine in a locked room) there is no difference between the certificate they create, and the certificate you create yourself. So after all my rambling these facts remain: 1) Apple is going to pull the plug on us Jan 1, 2017 2) We don't know if our apps will fail, so we're planning on the fact that they will 3) We're going to need SSL Certs on our BT servers (and eventually all servers) 4) We can either buy them, or make them ourselves. If you're interested in creating your own, you'll want to study Open SSL a bit. https://www.openssl.org Hope this helps. Cheers! -- Smug
 
maverick96
Lost but trying
Profile
Posts: 174
Reg: Jan 22, 2014
Orlando
3,390
like
08/28/16 05:13 PM (8 years ago)
Wow. Thank you so much for that update. Kinda sucks that its going that way so I will definitely study up on it. Appreciate it!
 
maverick96
Lost but trying
Profile
Posts: 174
Reg: Jan 22, 2014
Orlando
3,390
like
08/28/16 05:30 PM (8 years ago)
Just to add/ask, if my app is done through Buzztouch's site and not on a self-hosting server, will the SSL be established through buzztouch?
 
SmugWimp
Smugger than thou...
Profile
Posts: 6316
Reg: Nov 07, 2012
Tamuning, GU
81,410
like
08/28/16 06:26 PM (8 years ago)
If your app is published via your BT Server account, it's up to David to ensure that the SSL certificate is kept current. So what that basically means is, if your app is run through BT, you shouldn't have to worry. Cheers! -- Smug
 

Login + Screen Name Required to Post

pointerLogin to participate so you can start earning points. Once you're logged in (and have a screen name entered in your profile), you can subscribe to topics, follow users, and start learning how to make apps like the pros.