I don't have any experience on this kind of things, so please bear with me.

And I apologise if this has been asked before, but I couldn't find it in this site.

My situation:

  • I have a Windows Server (IIS) with a web site and web services running.
  • I have an iOS app using such web services.

In the near future I'll migrate such web site and web services to AWS with Linux, but first I need to adopt ATS.

For reference to the next follow this link

Apple is asking developers to adopt ATS as soon as possible.

In the App Transport Security documentation says "forward secrecy" (which I'm not sure what exactly means)

In addition, your communication through higher-level APIs needs to be encrypted using TLS version 1.2 with forward secrecy. If you try to make a connection that doesn't follow this requirement, an error is thrown.

My questions:

  • I don't know how to create/request a certificate(s) for this to work. If you can point me in the right direction, it would be great (a link will be enough).

  • Which provider would you recommend to request such certificate(s)?

  • Will the same certificate(s) work when I move the web site and web services to AWS in Linux?



To answer your explicit questions:

  1. Basically you need to create a certificate sign request (CSR) which then will be used by a certificate authority of your choosing to create the actual certificate. Creating a CSR can be done by multiple ways, some CAs actually have own tools that are very user friendly.
  2. Well the thing to do is checking out various CA's websites and compare what they offer and of course for what price (you might consider even https://letsencrypt.org/).
  3. Yes. The only thing you need to do is correctly configure the new server.

Forward secrecy in secure communication means that if your private key gets compromised anytime in the future, past communication secured using this key are not at risk of being deciphered. See this article for more detail. This can not be ensured directly by using a specific certificate, but rather by the used cipher suite (e.g. suites using DHE-RSA for key exchange) which is chosen when establishing a secure connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.