title: Accept untrusted SSL server certificate with CFStream socket on iOS
body: <p>I need to open a CFStream socket connection to a server that has an untrusted CA root. I have the certificate of the server, and I can create a <code>SecCertificateRef</code> structure from it. The problem is how to set up the properties of the stream. </p>
  
  <p>I think I should set the <code>kCFStreamPropertySSLSettings</code> property to a <code>CFDictionary</code> that in turn contains a <code>kCFStreamSSLCertificates</code> key. This key should hold a "a CFArray of SecCertificateRefs except for the first element in the array, which is a SecIdentityRef" according to the docs. Now I can create the <code>SecCertificateRef</code> from the server's certificate that I'll ship with the app, but how to get the <code>SecIdentityRef</code>? I guess it should be the client identity but I <em>absolutely don't want client side authentication</em> for now. And I can't find a way how to feed CFStream only with the server certificate.</p>
  
  <p>Note, I don't want to add the untrusted certificate to the keychain, neither disable kCFStreamSSLValidatesCertificateChain in the settings. I need to accept the server authentication only if it is based on my own server certificate data loaded from the disk, and only on this CFStream.</p>