Skip to content

Conversation

@singpolyma
Copy link

@singpolyma singpolyma commented Jul 8, 2025

Use native SSL on Apple OS instead of mbedtls. Especially needed on iOS where the root CA store cannot be read.

Fixes #570

Use native SSL on Apple OS instead of mbedtls. Especially needed on iOS
where the root CA store cannot be read.
@Aidan63
Copy link
Contributor

Aidan63 commented Jul 10, 2025

I think using OS SSL libraries where possible is a good idea (I've got a pending merge in #1135 which does it for Windows) and have looked at this mac library before, I've got a few comments though.

  • Secure Transport is deprecated and it is now recommended to use the Network Framework instead, this is important as Secure Transport does not support TLS 1.3. Hxcpp doesn't at the moment either but the pending mbedtls update and the Windows SChannel merges would add TLS 1.3 support, so this would be a step backwards for mac users.
  • Do Apply have cryptographic libraries which can be used to implement all the hashing and digest functions? Would be nice to use those if possible as it would allow mac builds to not need mbedtls at all.
  • Could we have a flag to switch back to mbedtls for mac? In WinCrypt and Friends SSL Implementation #1135 I have it set to use SChannel by default but the HXCPP_USE_MBEDTLS flag allows you to go back to mbedtls.

@barisyild
Copy link
Contributor

barisyild commented Dec 7, 2025

I think best solution is using native http api of apple os.

The sample code is a nme wrapper, so it requires a few changes to compile.
Below is an example of a working haxe bridge, @:objc is required.

#if ios
private function iOSResponse(data:NSData, response:NSURLResponse, error:NSError)
{
	var statusCode = -1;
	if (response != null) {
		var httpResponse:NSHTTPURLResponse = untyped __cpp__("(NSHTTPURLResponse *) {0}", response);
		statusCode = httpResponse.statusCode;
	}

	var shouldRetry = (error != null) || (statusCode >= 500);

	if (shouldRetry && retryCount < maxRetries)
	{
		retryCount++;
		Sys.println('${urlRequest.url} request failed, retrying... Attempt ${retryCount} status code ${statusCode}');
		runiOS();
		return;
	}

	if (error != null || statusCode >= 400)
	{
		onError(error != null ? error.localizedDescription.toString() : '${statusCode}');
		return;
	}

	onStatus(statusCode);
	retryCount = 0;

	var bytes = data.toBytes();
	if (urlLoader.dataFormat== URLLoaderDataFormat.BINARY)
	{
		byteData = ByteArray.fromBytes(bytes);
	}
	else
	{
		stringData = bytes.getString(0, bytes.length, UTF8);
	}

	state = URLLoader.urlComplete;
}

public function runiOS() {
	var url:NSURL = NSURL.URLWithString(this.urlRequest.url);
	var request:NSMutableURLRequest = NSMutableURLRequest.requestWithURL(url);

	for(header in headers.keys())
	{
		var value:String = Std.string(headers.get(header));
		request.setValueForHTTPHeaderField(value, header);
	}

	var session:NSURLSession = NSURLSession.sharedSession();
	var task:NSURLSessionDataTask = session.dataTaskWithRequestCompletionHandler(request, untyped __cpp__('^(NSData *data, NSURLResponse *response, NSError *error) {
		dispatch_async(dispatch_get_main_queue(), ^{
			{0}(data, response, error);
		});
	}', iOSResponse));

	task.resume();
}
#end

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[ios] SSL - No CA Chain is set, but required to operate

3 participants