在info.plist刪掉或改為NO

單向認(rèn)證示例代碼

+ (AFSecurityPolicy *)customSecurityPolicy { // 先導(dǎo)入證書，在這加證書，一般情況適用于單項(xiàng)認(rèn)證 // 證書的路徑 NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"xxx" ofType:@"cer"];NSData *cerData = [NSData dataWithContentsOfFile:cerPath];if (cerData == nil) { return nil; } NSSet *setData = [NSSet setWithObject:cerData]; //AFSSLPinningModeCertificate 使用證書驗(yàn)證模式 AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];// allowInvalidCertificates 是否允許無效證書(也就是自建的證書)，默認(rèn)為NO // 如果是需要驗(yàn)證自建證書，需要設(shè)置為YES securityPolicy.allowInvalidCertificates = YES;// validatesDomainName 是否需要驗(yàn)證域名，默認(rèn)為YES; // 假如證書的域名與你請求的域名不一致，需要把該項(xiàng)設(shè)置為NO；如設(shè)成NO的話，即服務(wù)器使用其他可信任機(jī)構(gòu)頒發(fā)的證書，也可以建立連接，這個(gè)非常危險(xiǎn)，建議打開。 // 設(shè)置為NO，主要用于這種情況：客戶端請求的事子域名，而證書上的是另外一個(gè)域名。因?yàn)镾SL證書上的域名是獨(dú)立的，假如證書上注冊的域名是www.google.com,那么mail.google.com是無法驗(yàn)證通過的；當(dāng)然有錢可以注冊通配符的域名*.google.com，但這個(gè)還是比較貴的。 // 如設(shè)置為NO，建議自己添加對應(yīng)域名的校驗(yàn)邏輯。 securityPolicy.validatesDomainName = NO;[securityPolicy setPinnedCertificates:setData];return securityPolicy; } 

然后在相應(yīng)位置加入

[manager setSecurityPolicy:[self customSecurityPolicy]]; 

AFNetworking定義了三種SSLpinningmode：
AFSSLPinningModeNone: 代表客戶端無條件地信任服務(wù)器端返回的證書

AFSSLPinningModePublicKey : 代表客戶端會(huì)將服務(wù)器端返回的證書與本地保存的證書PublicKey的部分進(jìn)行校驗(yàn);如果正確，才繼續(xù)進(jìn)行。

AFSSLPinningModeCertificate: 代表客戶端會(huì)將服務(wù)器端返回的證書和本地保存的證書中的所有內(nèi)容，包括PublicKey和證書部分，全部進(jìn)行校驗(yàn);如果正確，才繼續(xù)進(jìn)行。

雙向認(rèn)證示例代碼

http://blog.csdn.net/guobing19871024/article/details/53841373
http://blog.csdn.net/jerryvon/article/details/8548802

//校驗(yàn)證書 + (void)checkCredential:(AFURLSessionManager *)manager { [manager setSessionDidBecomeInvalidBlock:^(NSURLSession * _Nonnull session, NSError * _Nonnull error) { }]; __weak typeof(manager)weakManager = manager; [manager setSessionDidReceiveAuthenticationChallengeBlock:^NSURLSessionAuthChallengeDisposition(NSURLSession*session, NSURLAuthenticationChallenge *challenge, NSURLCredential *__autoreleasing*_credential) { NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengePerformDefaultHandling; __autoreleasing NSURLCredential *credential =nil; NSLog(@"authenticationMethod=%@",challenge.protectionSpace.authenticationMethod); //判斷是核驗(yàn)客戶端證書還是服務(wù)器證書 if([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) { // 基于客戶端的安全策略來決定是否信任該服務(wù)器，不信任的話，也就沒必要響應(yīng)挑戰(zhàn) if([weakManager.securityPolicy evaluateServerTrust:challenge.protectionSpace.serverTrust forDomain:challenge.protectionSpace.host]) { // 創(chuàng)建挑戰(zhàn)證書（注：挑戰(zhàn)方式為UseCredential和PerformDefaultHandling都需要新建挑戰(zhàn)證書） NSLog(@"serverTrust=%@",challenge.protectionSpace.serverTrust); credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust]; // 確定挑戰(zhàn)的方式 if (credential) { //證書挑戰(zhàn)設(shè)計(jì)policy,none，則跑到這里 disposition = NSURLSessionAuthChallengeUseCredential; } else { disposition = NSURLSessionAuthChallengePerformDefaultHandling; } } else { disposition = NSURLSessionAuthChallengeCancelAuthenticationChallenge; } } else { // client authentication SecIdentityRef identity = NULL; SecTrustRef trust = NULL; NSString *p12 = [[NSBundle mainBundle] pathForResource:@"xxx"ofType:@"p12"]; NSFileManager *fileManager =[NSFileManager defaultManager];if(![fileManager fileExistsAtPath:p12]) { NSLog(@"client.p12:not exist"); } else { NSData *PKCS12Data = [NSData dataWithContentsOfFile:p12];if ([self extractIdentity:&identity andTrust:&trust fromPKCS12Data:PKCS12Data]) { SecCertificateRef certificate = NULL; SecIdentityCopyCertificate(identity, &certificate); const void*certs[] = {certificate}; CFArrayRef certArray =CFArrayCreate(kCFAllocatorDefault, certs,1,NULL); credential =[NSURLCredential credentialWithIdentity:identity certificates:(__bridgeNSArray*)certArray persistence:NSURLCredentialPersistencePermanent]; disposition =NSURLSessionAuthChallengeUseCredential; } } } *_credential = credential; return disposition; }]; }//讀取p12文件中的密碼 + (BOOL)extractIdentity:(SecIdentityRef*)outIdentity andTrust:(SecTrustRef *)outTrust fromPKCS12Data:(NSData *)inPKCS12Data { OSStatus securityError = errSecSuccess; //client certificate password NSDictionary *optionsDictionary = [NSDictionary dictionaryWithObject:@"123456" forKey:(__bridge id)kSecImportExportPassphrase];CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL); securityError = SecPKCS12Import((__bridge CFDataRef)inPKCS12Data,(__bridge CFDictionaryRef)optionsDictionary,&items);if(securityError == 0) { CFDictionaryRef myIdentityAndTrust =CFArrayGetValueAtIndex(items,0); const void*tempIdentity =NULL; tempIdentity= CFDictionaryGetValue (myIdentityAndTrust,kSecImportItemIdentity); *outIdentity = (SecIdentityRef)tempIdentity; const void*tempTrust =NULL; tempTrust = CFDictionaryGetValue(myIdentityAndTrust,kSecImportItemTrust); *outTrust = (SecTrustRef)tempTrust; } else { NSLog(@"Failedwith error code %d",(int)securityError); return NO; } return YES; } 

然后在相應(yīng)位置加入

[manager setSecurityPolicy:[self customSecurityPolicy]]; [self checkCredential:manager];

三、NSURLConnection、NSURLSession適配

http://www.cnblogs.com/lmfboke/p/6232656.html
http://oncenote.com/2014/10/21/Security-1-HTTPS/
http://www.jianshu.com/p/97745be81d64

四、其他

SDWebImage繞過證書驗(yàn)證去加載圖片

[imageView sd_setImageWithURL:[NSURL URLWithString:urlString] placeholderImage:self.placeholder options:SDWebImageAllowInvalidSSLCertificates]; 

五、部分參考

http://www.jianshu.com/p/72bf60b5f94d
http://www.cnblogs.com/lmfboke/p/6232656.html
http://blog.csdn.net/iostiannan/article/details/53763082
http://www.wosign.com/faq/faq-ios-https.htm
http://www.cocoachina.com/ios/20150702/12384.html
http://www.wosign.com/news/ios-app-https.htm
http://www.cocoachina.com/ios/20161207/18308.html
http://edison0663.iteye.com/blog/996526

本頁內(nèi)容由塔燈網(wǎng)絡(luò)科技有限公司通過網(wǎng)絡(luò)收集編輯所得，所有資料僅供用戶學(xué)習(xí)參考，本站不擁有所有權(quán)，如您認(rèn)為本網(wǎng)頁中由涉嫌抄襲的內(nèi)容，請及時(shí)與我們聯(lián)系，并提供相關(guān)證據(jù)，工作人員會(huì)在5工作日內(nèi)聯(lián)系您，一經(jīng)查實(shí)，本站立刻刪除侵權(quán)內(nèi)容。本文鏈接:http://www.junxiaosheng.cn/20513.html