这是我使用自签名证书进行身份验证的非常标准的NSURLConnection回调：
- (SecCertificateRef)certRefFromDerNamed:(NSString*)derFileName resultingDataRef:(CFDataRef*)dataRefPtr{
NSString *thePath = [[NSBundle mainBundle] pathForResource:derFileName ofType:@"der"];
NSData *certData = [[NSData alloc] initWithContentsOfFile:thePath];
CFDataRef certDataRef = (__bridge_retained CFDataRef)certData;
SecCertificateRef cert = SecCertificateCreateWithData(NULL,certDataRef);
*dataRefPtr = certDataRef;
return cert;
}
- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
if (connection == self.connection) {
BOOL trusted = NO;
if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
SecPolicyRef policyRef = SecPolicyCreateBasicX509();
SecCertificateRef cert1;
CFDataRef certData1;
cert1 = [self certRefFromDerNamed:@"some3rdpartycacert" resultingDataRef:&certData1];
SecCertificateRef certArray[1] = { cert1 };
CFArrayRef certArrayRef = CFArrayCreate(NULL,(void *)certArray,1,NULL);
SecTrustRef serverTrust = challenge.protectionSpace.serverTrust;
SecTrustSetAnchorCertificates(serverTrust,certArrayRef);
SecTrustResultType trustResult;
SecTrustEvaluate(serverTrust,&trustResult);
trusted = (trustResult == kSecTrustResultUnspecified);
CFRelease(certArrayRef);
CFRelease(policyRef);
CFRelease(cert1);
CFRelease(certData1);
}
if (trusted) {
[challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
} else {
[challenge.sender performDefaultHandlingForAuthenticationChallenge:challenge];
}
}
}
而且trustResult总是kSecTrustResultRecoverableTrustFailure.
证书本身有点问题.根据服务器上的curl cert主题名称与我正在连接的url不匹配.我已经联系了第三方公司,他们告诉我,我需要在我的代码中接受这个url不匹配.问题是我不知道如何在iOS上这样做.我可以完全绕过证书检查(通过简单地假设trusted = YES并调用useCredential)或完全失败.从安全角度来看,第一种解决方案显然是错误的,并且容易发生MITM攻击.
这是CURL输出(我在这里使用了相同证书的PEM版本)：
ukaszs-iMac:Preferences lukasz$ curl --verbose --cacert ~/Desktop/some3rdpartycacert.txt https://dev-service.some3rdparty.com:50101/ * About to connect() to dev-service.some3rdparty.com port 50101 (#0) * Trying XXX.XXX.XXX.XXX... * connected * Connected to dev-service.some3rdparty.com (XXX.XXX.XXX.XXX) port 50101 (#0) * successfully set certificate verify locations: * CAfile: /Users/lukasz/Desktop/some3rdpartycacert.txt CApath: none * SSLv3,TLS handshake,Client hello (1): * SSLv3,Server hello (2): * SSLv3,CERT (11): * SSLv3,Request CERT (13): * SSLv3,Server finished (14): * SSLv3,Client key exchange (16): * SSLv3,TLS change cipher,Finished (20): * SSLv3,Finished (20): * SSL connection using AES256-SHA * Server certificate: * subject: C=CA; ST=Ontario; O=Some 3rdParty Corporation; CN=otherpage.some3rdparty.com; emailAddress=noc@some3rdparty.com * start date: 2013-10-30 16:52:14 GMT * expire date: 2013-10-30 16:52:14 GMT * SSL: certificate subject name 'otherpage.some3rdparty.com' does not match target host name 'dev-service.some3rdparty.com' * Closing connection #0 * SSLv3,TLS alert,Client hello (1): curl: (51) SSL: certificate subject name 'otherpage.some3rdparty.com' does not match target host name 'dev-service.some3rdparty.com'
那么,如何忽略iOS上的这个特殊错误？
解决方法
您需要使用实际主机名创建特殊策略,然后从中创建和评估serverTrust.大致：
SecPolicyRef policyRef = SecPolicyCreateSSL(true,CFSTR("otherpage.some3rdparty.com"));
OSStatus status;
SecTrustRef serverTrust;
status = SecTrustCreateWithCertificates(certificatesFromOriginalServerTrust,policyRef,& serverTrust);
// noErr == status?
status = SecTrustSetAnchorCertificates(serverTrust,certArrayRef);
// noErr == status?
SecTrustResultType trustResult;
status = SecTrustEvaluate(serverTrust,&trustResult);
// noErr == status?
if(kSecTrustResultProceed == trustResult || kSecTrustResultUnspecified == trustResult) {
// all good
}
附：您没有使用您创建的政策.
我刚刚找到了一个更完整的解释here.
