Why iOS blocks the connection
App Transport Security requires TLS connections that the operating system can validate. A self-signed certificate does not establish a public chain of trust, even when the server is legitimate and works correctly inside the client's network.
Disabling validation in the application looks like a quick fix, but it turns a security restriction into a permanent exception. It also leaves connection logic and often sensitive credentials inside the mobile binary.
The thin proxy
The solution was to place a small service with a valid public certificate in front of the existing server. The mobile app communicates only with that service, which validates requests, adds server-side credentials and translates the response without modifying the tracking system.
The proxy also provides a controlled point for CORS, rate limits, logs and secret rotation. Its responsibility must stay narrow so it does not become another full backend.
- Valid TLS with automatic renewal.
- Credentials kept out of iOS and Android binaries.
- An explicit list of allowed origins and operations.
- Timeouts, size limits and logs without sensitive data.
What the proxy must not hide
A proxy does not fix weak authentication by itself or make an obsolete protocol secure. The connection between the proxy and the original server must also be protected through a private network, VPN, firewall rules or specific certificate validation.
A sound architecture documents both segments, defines who rotates each secret and monitors certificate errors before they become an application outage.