Styjun

Stretch's answer appears to be a great workaround, but it uses deprecated APIs. So, I thought it might be worthy of an upgrade to the code.

For this code sample, I added the routines to the ViewController which contains my UIWebView. I made my UIViewController a UIWebViewDelegate and a NSURLConnectionDataDelegate. Then I added 2 data members: _Authenticated and _FailedRequest. With that, the code looks like this:

-(BOOL)webView:(UIWebView *)webView shouldStartLoadWithRequest:(NSURLRequest *)request navigationType:(UIWebViewNavigationType)navigationType 
 BOOL result = _Authenticated;
 if (!_Authenticated) 
 _FailedRequest = request;
 [[NSURLConnection alloc] initWithRequest:request delegate:self];
 
 return result;


-(void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge 
 if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) 
 NSURL* baseURL = [_FailedRequest URL];
 if ([challenge.protectionSpace.host isEqualToString:baseURL.host]) 
 NSLog(@"trusting connection to host %@", challenge.protectionSpace.host);
 [challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
 else
 NSLog(@"Not trusting connection to host %@", challenge.protectionSpace.host);
 
 [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];


-(void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)pResponse 
 _Authenticated = YES;
 [connection cancel];
 [_WebView loadRequest:_FailedRequest];

I set _Authenticated to NO when I load the view and don't reset it. This seems to allow the UIWebView to make multiple requests to the same site. I did not try switching sites and trying to come back. That may cause the need for resetting _Authenticated. Also, if you are switching sites, you should keep a dictionary (one entry for each host) for _Authenticated instead of a BOOL.

This is the Panacea!

BOOL _Authenticated;
NSURLRequest *_FailedRequest;

#pragma UIWebViewDelegate

-(BOOL)webView:(UIWebView *)webView shouldStartLoadWithRequest:(NSURLRequest *)request navigationType:(UIWebViewNavigationType)navigationType 
 BOOL result = _Authenticated;
 if (!_Authenticated) 
 _FailedRequest = request;
 NSURLConnection *urlConnection = [[NSURLConnection alloc] initWithRequest:request delegate:self];
 [urlConnection start];
 
 return result;


#pragma NSURLConnectionDelegate

-(void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge 
 if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) 
 NSURL* baseURL = [NSURL URLWithString:@"your url"];
 if ([challenge.protectionSpace.host isEqualToString:baseURL.host]) 
 NSLog(@"trusting connection to host %@", challenge.protectionSpace.host);
 [challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
 else
 NSLog(@"Not trusting connection to host %@", challenge.protectionSpace.host);
 
 [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];


-(void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)pResponse 
_Authenticated = YES;
 [connection cancel];
 [self.webView loadRequest:_FailedRequest];


- (void)viewDidLoad
 [super viewDidLoad];

 NSURL *url = [NSURL URLWithString:@"your url"];
 NSURLRequest *requestURL = [NSURLRequest requestWithURL:url];
 [self.webView loadRequest:requestURL];

// Do any additional setup after loading the view.

If you want to access a private server with a self-signed certificate just for testing you don't have to write code. You can manually do a system-wide import of the certificate.

To do this, you need to download the server certificate with mobile safari, which then prompts for an import.

This would be usable under the following circumstances:

• the number of test devices is small


• you're trusting the certificate of the server

If you don't have access to the server certificate, you can fallback to the following method for extracting it from any HTTPS-server (at least on Linux/Mac, windows guys will have to download an OpenSSL binary somewhere):

echo "" | openssl s_client -connect $server:$port -prexit 2>/dev/null | sed -n -e '/BEGIN CERTIFICATE/,/END CERTIFICATE/ p' >server.pem

Note, that depending on the OpenSSL version, the certificate may be doubled in the file, so best have a look at it with a text editor. Put the file somewhere on the network or use the

python -m SimpleHTTPServer 8000

shortcut to access it from your mobile safari at http://$your_device_ip:8000/server.pem.

This is a clever workaround. However, a possibly better (although more code intensive) solution would be to use an NSURLProtocol as demonstrated in Apple's CustomHTTPProtocol sample code. From the README:

"CustomHTTPProtocol shows how to use an NSURLProtocol subclass to intercept the NSURLConnections made by a high-level subsystem that does not otherwise expose its network connections. In this specific case, it intercepts the HTTPS requests made by a web view and overrides server trust evaluation, allowing you to browse a site whose certificate is not trusted by default."

Checkout the full example:
https://developer.apple.com/library/ios/samplecode/CustomHTTPProtocol/Introduction/Intro.html

This is a swift 2.0 compatible equivalent that works for me. I have not converted this code to use NSURLSession instead of NSURLConnection, and suspect that it would add a lot of complexity to get it right.

var authRequest : NSURLRequest? = nil
var authenticated = false
var trustedDomains = [:] // set up as necessary

func webView(webView: UIWebView, shouldStartLoadWithRequest request: NSURLRequest, navigationType: UIWebViewNavigationType) -> Bool 
 if !authenticated 
 authRequest = request
 let urlConnection: NSURLConnection = NSURLConnection(request: request, delegate: self)!
 urlConnection.start()
 return false
 
 else if isWebContent(request.URL!) // write your method for this
 return true
 
 return processData(request) // write your method for this


func connection(connection: NSURLConnection, willSendRequestForAuthenticationChallenge challenge: NSURLAuthenticationChallenge) 
 if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust 
 let challengeHost = challenge.protectionSpace.host
 if let _ = trustedDomains[challengeHost] 
 challenge.sender!.useCredential(NSURLCredential(forTrust: challenge.protectionSpace.serverTrust!), forAuthenticationChallenge: challenge)
 
 
 challenge.sender!.continueWithoutCredentialForAuthenticationChallenge(challenge)


func connection(connection: NSURLConnection, didReceiveResponse response: NSURLResponse) 
 authenticated = true
 connection.cancel()
 webview!.loadRequest(authRequest!)

Here the working code of swift 2.0

var authRequest : NSURLRequest? = nil
var authenticated = false


func webView(webView: UIWebView, shouldStartLoadWithRequest request: NSURLRequest, navigationType: UIWebViewNavigationType) -> Bool 
 if !authenticated 
 authRequest = request
 let urlConnection: NSURLConnection = NSURLConnection(request: request, delegate: self)!
 urlConnection.start()
 return false
 
 return true


func connection(connection: NSURLConnection, didReceiveResponse response: NSURLResponse) 
 authenticated = true
 connection.cancel()
 webView!.loadRequest(authRequest!)


func connection(connection: NSURLConnection, willSendRequestForAuthenticationChallenge challenge: NSURLAuthenticationChallenge) 

 let host = "www.example.com"

 if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust &&
 challenge.protectionSpace.host == host 
 let credential = NSURLCredential(forTrust: challenge.protectionSpace.serverTrust!)
 challenge.sender!.useCredential(credential, forAuthenticationChallenge: challenge)
 else 
 challenge.sender!.performDefaultHandlingForAuthenticationChallenge!(challenge)
 

To build off of @spirographer's answer, I put something together for a Swift 2.0 use case with NSURLSession. However, this is still NOT working. See more below.

func webView(webView: UIWebView, shouldStartLoadWithRequest request: NSURLRequest, navigationType: UIWebViewNavigationType) -> Bool 
 let result = _Authenticated
 if !result 
 let sessionConfiguration = NSURLSessionConfiguration.defaultSessionConfiguration()
 let session = NSURLSession(configuration: sessionConfiguration, delegate: self, delegateQueue: NSOperationQueue.mainQueue())
 let task = session.dataTaskWithRequest(request) 
 (data, response, error) -> Void in
 if error == nil 
 if (!self._Authenticated) 
 self._Authenticated = true;
 let pageData = NSString(data: data!, encoding: NSUTF8StringEncoding)
 self.webView.loadHTMLString(pageData as! String, baseURL: request.URL!)

 else 
 self.webView.loadRequest(request)
 
 
 
 task.resume()
 return false
 
 return result


func URLSession(session: NSURLSession, didReceiveChallenge challenge: NSURLAuthenticationChallenge, completionHandler: (NSURLSessionAuthChallengeDisposition, NSURLCredential?) -> Void) 
 completionHandler(NSURLSessionAuthChallengeDisposition.UseCredential, NSURLCredential(forTrust: challenge.protectionSpace.serverTrust!))

I will get back the initial HTML response, so the page renders the plain HTML, but there is no CSS styles applied to it (seems like the request to get CSS is denied). I see a bunch of these errors:

NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)

It seems like any request made with webView.loadRequest is done not within the session, which is why the connection is rejected. I do have Allow Arbitrary Loads set in Info.plist. What confuses me is why NSURLConnection would work (seemingly the same idea), but not NSURLSession.

First thing UIWebView is deprecated

use WKWebView instead (available from iOS8)

set webView.navigationDelegate = self

implement

extension ViewController: WKNavigationDelegate 

func webView(_ webView: WKWebView, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) 
 let trust = challenge.protectionSpace.serverTrust!
 let exceptions = SecTrustCopyExceptions(trust)
 SecTrustSetExceptions(trust, exceptions)
 completionHandler(.useCredential, URLCredential(trust: trust))
 

And add this in plist with domains you want to allow

<key>NSAppTransportSecurity</key>
<dict>
 <key>NSExceptionDomains</key>
 <dict>
 <key>localhost</key>
 <dict>
 <key>NSTemporaryExceptionAllowsInsecureHTTPSLoads</key>
 <false/>
 <key>NSIncludesSubdomains</key>
 <true/>
 <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
 <true/>
 <key>NSTemporaryExceptionMinimumTLSVersion</key>
 <string>1.0</string>
 <key>NSTemporaryExceptionRequiresForwardSecrecy</key>
 <false/>
 </dict>
 </dict>
</dict>