Xamarin WKWebView Accepting Self-Signed Certificates

Question

I have seen various example online saying how to accept them but I always get An SSL error has occurred and a secure connection to the server cannot be made.

Answer 1

To support self-signed certs you have two things to do:

1. Allow NSExceptionAllowsInsecureHTTPLoads on your self-signed domain
   • Even though you are using https, your app is flagged as having a trust issue
2. Bypass certificate security checking

Security Note on 2: Get a CA-issued certificate for any production apps as this completely disables certificate validation on your domain and thus allowing MITM attacks, DNS redirection spoofing of your app, etc... You could pin the cert by including the public cer in the main bundle and checking it against the cert received, but that just means a fake certificate would need to be generated in either the MITM or DNS spoofing attack (and tools for those already exist in the various exploit kits)

Example using the https://badssl.com site:

WKNavigationDelegate:

public class NavigationDelegate : WKNavigationDelegate
{
    const string host = "self-signed.badssl.com";
    public override void DidReceiveAuthenticationChallenge(WKWebView webView, NSUrlAuthenticationChallenge challenge, Action completionHandler)
    {
        switch (challenge.ProtectionSpace.Host)
        {
            case host:
                using (var cred = NSUrlCredential.FromTrust(challenge.ProtectionSpace.ServerSecTrust))
                {
                    completionHandler.Invoke(NSUrlSessionAuthChallengeDisposition.UseCredential, cred);
                }
                break;
            default:
                completionHandler.Invoke(NSUrlSessionAuthChallengeDisposition.PerformDefaultHandling, null);
                break;
        }
    }
}

Note: Assign an instance of this class to the NavigationDelegate or WeakNavigationDelegate of your WKWebView instance.

Info.plist NSAppTransportSecurity:

NSAppTransportSecurity

    NSExceptionDomains
    
        self-signed.badssl.com
        
            NSExceptionAllowsInsecureHTTPLoads