Take the 2-minute tour ×

I'm looking at creating an iPhone app that will communicate with a REST Web service. Because some user-sensitive data (name, address, age, etc) will be transmitted, I'm looking at securing the connections with SSL.

However, on my previous escapades into App Store submission, I saw that the first question I get asked is "Does your application use encryption?" and depending on the answer to this and other follow-up questions, may require US export compliance.

My company is not based in the US, nor do we have a US office.

Has anyone else submitted an app using SSL for this sort of purpose? If so, did you need to do anything to get permission to use it, either from Apple or from the US government?

share|improve this question
add comment

4 Answers

up vote 28 down vote accepted

For other people coming to find this answer:

The process has changed, as of Summer 2010, and you (probably) need an ERN now, not a CCATS as was necessary at the time John wrote his answer.

See Apple iTunes export restrictions on apps. The iTunes connect faq also contains a lot of useful information on export compliance.

There are also now restrictions that apply to distributing apps with encryption on the French app store - see the itunes connect FAQ and the French Export Compliance thread on the devforums.

share|improve this answer
Thanks for the update - very good to know. –  John Jan 21 '11 at 2:44
add comment

I actually went back to Apple and it turns out that any application using SSL does need approval (unfortunately). There are apparently some exceptions, such as if the application uses SSL only for a single payment transaction.

There is more information in Mass Market Encryption CCATS Commodity Classification for iPhone Applications in 8 Easy Steps and iPhone Encryption Export Compliance for Apps making HTTPS (TLS) Connections.

share|improve this answer
It also depends on the use of cryptography. If you are only using cryptography for authentication, then you don't need an export license from the Department of Commerce. So eNULL cipher suites are OK (but I'm not sure how useful they are). –  noloader Feb 14 at 7:53
add comment

I ran across this question earlier today and thought I'd come back to report my experience.

Check out: http://tigelane.blogspot.com/2011/01/apple-itunes-export-restrictions-on.html for a procedure that worked well for me (be sure to read the whole thing including the comments -- there have been some changes since the original post, mostly for the better, and the updated info is in the comments).

The process is pretty streamlined now (except for Safari and Chrome not recognizing their own site's SSL certificate. A little ironic there. :-); I got approval about 10-15 minutes after submitting the info.

I'd guess that this has become a routine thing for them (at least if you're only using SSL rather than some kind of exotic crypto).

share|improve this answer
add comment

Because the app is setting up and using secure SSL connections it is considered an encryption product. The US export controls depend on whether you use encryption, not where you find it. It doesn't matter that you are using a built-in function instead of writing your own, using a commercial library, or using a specialized processor--it is still an encryption item.

Check out the BIS web site at www.bis.doc.gov/encryption or call the help desk at 202-482-0707 if you want to discuss the particulars of your app. If you find out you need an encryption classification then the link for the SNAPR is there too.

share|improve this answer
add comment

Your Answer


