title: iOS 11, 12, and 13 installed certificates not trusted automatically (self signed)
body: <p>On our internal network, we use a self-signed CA certificate. This has worked fine for years, in both Safari and our iOS product, all the way through iOS 10. We simply install the CA certificate on any new device or simulator and everything works, even with ATS. This allows access to all of our internal test servers without having to trust each server individually.</p>
  
  <p>Starting with iOS 11 the installed CA certificate no longer allows Safari or our app to trust the certificate for any of the servers. We receive the following relevant details with <code>CFNETWORK_DIAGNOSTICS</code> enabled for our app:</p>
  
  <blockquote>
    <p>Error Domain=kCFErrorDomainCFNetwork Code=<strong>-1200</strong>
    <br>_kCFNetworkCFStreamSSLErrorOriginalValue=<strong>-9802</strong>
    <br>_kCFStreamErrorDomainKey=<strong>3</strong>
    <br>_kCFStreamErrorCodeKey=<strong>-9802</strong>
    <br>NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made.
    <br>NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?</p>
  </blockquote>
  
  <p>I spent considerable time trying to resolve this issue, scouring StackOverflow and the rest of the web. Although we use AFNetworking in our app, that seems to be irrelevant, as Safari no longer trusts these servers via the CA. Disabling ATS via <code>NSAllowsArbitraryLoads</code> allows access to the servers, but obviously isn't a solution.</p>
  
  <p>No changes have been made to our <code>-URLSession:didReceiveChallenge:completionHandler</code> code, and we have a proper (worked for years) implementation of challenge response via <code>challenge.protectionSpace.serverTrust</code>.</p>
  
  <p>I have re-evaluated and tested both the CA and server certificates every way I can think of, and they work everywhere except iOS 11. What might have changed in ATS for iOS 11 that could cause this issue?</p>