ATS issues with Apple iOS

Ats

APP Transport Security, a new feature in IOS9, is an important improvement in Apple's network communications security. In iOS 9 and OS X 10.11, non-HTTPS network access is prohibited by default, and before January 1, 2017, in order to reduce the impact, we can add the "nsapptransportsecurity" dictionary to the Info.plist and " Nsallowsarbitraryloads "set to" YES "to disable ATS. However, after January 1, 2017, this method is no longer allowed to bypass ATS, so the new submitted app network requests must be HTTPS encryption, or you may be in the application of audit problems.

The ATS network connection requires that the ATS feature be fully enabled, requires your app connection to use HTTPS links, and meets the following security requirements:

1. An SSL certificate issued by a trusted authority issuing the root certificate in the list of trusted root certificates for iOS.

(All SSL certificate products for Symantec,geotrust,rapidssl are in the iOS Trusted root certificate list)

2, SSL certificate must be RSA 2048 bit above, and use SHA256 signature.

(All SSL certificate products of SYMANTEC,GEOTRUST,RAPIDSSL meet this condition)

3, the negotiated TLS communication protocol must be above TLS 1.2.

4, the connection must use AES-128 and AES-256 symmetric encryption algorithm, TLS negotiated encryption suite must support Ecdhe (Elliptic Curve diffie-hellman ephemeral) key exchange algorithm to implement the PFS characteristics (Perfect Forward Secury), the following cryptographic suite algorithms are supported:

• tls_ecdhe_ecdsa_with_aes_256_gcm_sha384
• tls_ecdhe_ecdsa_with_aes_128_gcm_sha256
• tls_ecdhe_ecdsa_with_aes_256_cbc_sha384
• Tls_ecdhe_ecdsa_with_aes_256_cbc_sha
• tls_ecdhe_ecdsa_with_aes_128_cbc_sha256
• Tls_ecdhe_ecdsa_with_aes_128_cbc_sha
• tls_ecdhe_rsa_with_aes_256_gcm_sha384
• tls_ecdhe_rsa_with_aes_128_gcm_sha256
• tls_ecdhe_rsa_with_aes_256_cbc_sha384
• tls_ecdhe_rsa_with_aes_128_cbc_sha256
• Tls_ecdhe_rsa_with_aes_128_cbc_sha

Web Server implements ATS functionality

Windows IIS Configuration Notes

Apache Configuration Instructions

Tomcat Configuration Instructions

Nginx Configuration Instructions

F5 Configuration Instructions

Fyi:https://www.myssl.cn/home/article-38.html

ATS issues with Apple iOS