pokeb/asi-http-request — pull request #314 by james-chalfant (2012-03-10 01:30:59+00:00)
Title: Fix for self-signed client certificates on iOS 5 (alternate)

1.) Restructure handling of ssl options (i.e., kCFStreamPropertySSLSettings) so that disabling SSL certificate verification and adding an SSL client certificate are not mutually exclusive. Also removed several settings which appear unneeded to successfully use a self-signed certificate / a certificate using a self generated CA based on my testing; further context on the necessity of these options (kCFStreamSSLAllowsExpiredCertificates, kCFStreamSSLAllowsAnyRoot, setting kCFStreamSSLPeerName to kCFNull) would be useful.

2.) Add option to specify an SSL CA Certificate to use instead of the normal root certificates for verifying a server certificate. Note that this isn't handled in an ideal fashion - certificate verification is completely disabled for the initial handshake, then manually checked on the first read event (i.e., when handleNetworkEvent gets a kCFStreamEventHasBytesAvailable event). I was unable to succeed at other methods of adding a root CA certificate (adding it to the keychain, altering the ssl context)

FYI, this is my first time using github/submitting, so feedback is welcome.