title: Determining Trust With NSURLConnection and NSURLProtectionSpace
body: <p>I would like to ask a followup question to <a href="https://stackoverflow.com/questions/2949640/nsurlconnection-nsurlrequest-untrusted-cert-and-user-authentication"> a previously posed question</a>. I've got the code to create an NSURLRequest/Connection, run it and have the callback methods for authentication get called. Here's the specific code:</p>
  
  <pre><code>- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace {
      return [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust] || [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodDefault];
  }
  
  -(void)connection:(NSURLConnection *)connection
  didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
  {   
  
      if ([challenge previousFailureCount] &gt; 0) {
          [[challenge sender] cancelAuthenticationChallenge:challenge];
          NSLog(@"Bad Username Or Password");
          badUsernameAndPassword = YES;
          finished = YES;
          return;
      }
  
      if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust])
      {
          if (appDelegate._allowInvalidCert)
          {
              // Go ahead...trust me!
              [challenge.sender useCredential:
               [NSURLCredential credentialForTrust: challenge.protectionSpace.serverTrust] 
                   forAuthenticationChallenge: challenge];
          }
          else
          {
              TrustGenerator *tg = [[TrustGenerator alloc] init];
  
              if ([tg getTrust:challenge.protectionSpace])
              {
                  // Go ahead...trust me!
                  [challenge.sender useCredential:
                   [NSURLCredential credentialForTrust: challenge.protectionSpace.serverTrust] 
                       forAuthenticationChallenge: challenge];
              }
              else {
                  [[challenge sender] cancelAuthenticationChallenge:challenge];
              }
          }
      }
      else if ([[challenge protectionSpace] authenticationMethod] == NSURLAuthenticationMethodDefault) {
          NSURLCredential *newCredential = [NSURLCredential credentialWithUser:_username password:_password persistence:NSURLCredentialPersistenceNone];
          [[challenge sender] useCredential:newCredential forAuthenticationChallenge:challenge];
      }
  }
  </code></pre>
  
  <p>What I'm running into is that "didReceiveAuthenticationChallenge" with "[challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]" is <em>ALWAYS</em> being called, even when the certificate on the server I'm attempting to connect to is trusted (doing testing with a Verisign cert). So what I'm seeing is my application is always prompting the end user to trust even when the website is trusted. Bad karma considering that's what's suppose to happen with a man in the middle attack, etc. What I'm really looking for is some code like this:</p>
  
  <pre><code>        if (appDelegate._allowInvalidCert)
          {
              // Go ahead...trust me!
              [challenge.sender useCredential:
               [NSURLCredential credentialForTrust: challenge.protectionSpace.serverTrust] 
                   forAuthenticationChallenge: challenge];
          }
          else if(The OS trusts the cert on the server)
          {
               [challenge.sender useCredential:
                   [NSURLCredential credentialForTrust: challenge.protectionSpace.serverTrust] 
                       forAuthenticationChallenge: challenge];
          }
          else{...
  </code></pre>