在info.plist删掉或改为NO

单向认证示例代码

+ (AFSecurityPolicy *)customSecurityPolicy { // 先导入证书，在这加证书，一般情况适用于单项认证 // 证书的路径 NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"xxx" ofType:@"cer"];NSData *cerData = [NSData dataWithContentsOfFile:cerPath];if (cerData == nil) { return nil; } NSSet *setData = [NSSet setWithObject:cerData]; //AFSSLPinningModeCertificate 使用证书验证模式 AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];// allowInvalidCertificates 是否允许无效证书(也就是自建的证书)，默认为NO // 如果是需要验证自建证书，需要设置为YES securityPolicy.allowInvalidCertificates = YES;// validatesDomainName 是否需要验证域名，默认为YES; // 假如证书的域名与你请求的域名不一致，需要把该项设置为NO；如设成NO的话，即服务器使用其他可信任机构颁发的证书，也可以建立连接，这个非常危险，建议打开。 // 设置为NO，主要用于这种情况：客户端请求的事子域名，而证书上的是另外一个域名。因为SSL证书上的域名是独立的，假如证书上注册的域名是www.google.com,那么mail.google.com是无法验证通过的；当然有钱可以注册通配符的域名*.google.com，但这个还是比较贵的。 // 如设置为NO，建议自己添加对应域名的校验逻辑。 securityPolicy.validatesDomainName = NO;[securityPolicy setPinnedCertificates:setData];return securityPolicy; } 

然后在相应位置加入

[manager setSecurityPolicy:[self customSecurityPolicy]]; 

AFNetworking定义了三种SSLpinningmode：
AFSSLPinningModeNone: 代表客户端无条件地信任服务器端返回的证书

AFSSLPinningModePublicKey : 代表客户端会将服务器端返回的证书与本地保存的证书PublicKey的部分进行校验;如果正确，才继续进行。

AFSSLPinningModeCertificate: 代表客户端会将服务器端返回的证书和本地保存的证书中的所有内容，包括PublicKey和证书部分，全部进行校验;如果正确，才继续进行。

双向认证示例代码

http://blog.csdn.net/guobing19871024/article/details/53841373
http://blog.csdn.net/jerryvon/article/details/8548802

//校验证书 + (void)checkCredential:(AFURLSessionManager *)manager { [manager setSessionDidBecomeInvalidBlock:^(NSURLSession * _Nonnull session, NSError * _Nonnull error) { }]; __weak typeof(manager)weakManager = manager; [manager setSessionDidReceiveAuthenticationChallengeBlock:^NSURLSessionAuthChallengeDisposition(NSURLSession*session, NSURLAuthenticationChallenge *challenge, NSURLCredential *__autoreleasing*_credential) { NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengePerformDefaultHandling; __autoreleasing NSURLCredential *credential =nil; NSLog(@"authenticationMethod=%@",challenge.protectionSpace.authenticationMethod); //判断是核验客户端证书还是服务器证书 if([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) { // 基于客户端的安全策略来决定是否信任该服务器，不信任的话，也就没必要响应挑战 if([weakManager.securityPolicy evaluateServerTrust:challenge.protectionSpace.serverTrust forDomain:challenge.protectionSpace.host]) { // 创建挑战证书（注：挑战方式为UseCredential和PerformDefaultHandling都需要新建挑战证书） NSLog(@"serverTrust=%@",challenge.protectionSpace.serverTrust); credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust]; // 确定挑战的方式 if (credential) { //证书挑战设计policy,none，则跑到这里 disposition = NSURLSessionAuthChallengeUseCredential; } else { disposition = NSURLSessionAuthChallengePerformDefaultHandling; } } else { disposition = NSURLSessionAuthChallengeCancelAuthenticationChallenge; } } else { // client authentication SecIdentityRef identity = NULL; SecTrustRef trust = NULL; NSString *p12 = [[NSBundle mainBundle] pathForResource:@"xxx"ofType:@"p12"]; NSFileManager *fileManager =[NSFileManager defaultManager];if(![fileManager fileExistsAtPath:p12]) { NSLog(@"client.p12:not exist"); } else { NSData *PKCS12Data = [NSData dataWithContentsOfFile:p12];if ([self extractIdentity:&identity andTrust:&trust fromPKCS12Data:PKCS12Data]) { SecCertificateRef certificate = NULL; SecIdentityCopyCertificate(identity, &certificate); const void*certs[] = {certificate}; CFArrayRef certArray =CFArrayCreate(kCFAllocatorDefault, certs,1,NULL); credential =[NSURLCredential credentialWithIdentity:identity certificates:(__bridgeNSArray*)certArray persistence:NSURLCredentialPersistencePermanent]; disposition =NSURLSessionAuthChallengeUseCredential; } } } *_credential = credential; return disposition; }]; }//读取p12文件中的密码 + (BOOL)extractIdentity:(SecIdentityRef*)outIdentity andTrust:(SecTrustRef *)outTrust fromPKCS12Data:(NSData *)inPKCS12Data { OSStatus securityError = errSecSuccess; //client certificate password NSDictionary *optionsDictionary = [NSDictionary dictionaryWithObject:@"123456" forKey:(__bridge id)kSecImportExportPassphrase];CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL); securityError = SecPKCS12Import((__bridge CFDataRef)inPKCS12Data,(__bridge CFDictionaryRef)optionsDictionary,&items);if(securityError == 0) { CFDictionaryRef myIdentityAndTrust =CFArrayGetValueAtIndex(items,0); const void*tempIdentity =NULL; tempIdentity= CFDictionaryGetValue (myIdentityAndTrust,kSecImportItemIdentity); *outIdentity = (SecIdentityRef)tempIdentity; const void*tempTrust =NULL; tempTrust = CFDictionaryGetValue(myIdentityAndTrust,kSecImportItemTrust); *outTrust = (SecTrustRef)tempTrust; } else { NSLog(@"Failedwith error code %d",(int)securityError); return NO; } return YES; } 

然后在相应位置加入

[manager setSecurityPolicy:[self customSecurityPolicy]]; [self checkCredential:manager];

三、NSURLConnection、NSURLSession适配

http://www.cnblogs.com/lmfboke/p/6232656.html
http://oncenote.com/2014/10/21/Security-1-HTTPS/
http://www.jianshu.com/p/97745be81d64

四、其他

SDWebImage绕过证书验证去加载图片

[imageView sd_setImageWithURL:[NSURL URLWithString:urlString] placeholderImage:self.placeholder options:SDWebImageAllowInvalidSSLCertificates]; 

五、部分参考

http://www.jianshu.com/p/72bf60b5f94d
http://www.cnblogs.com/lmfboke/p/6232656.html
http://blog.csdn.net/iostiannan/article/details/53763082
http://www.wosign.com/faq/faq-ios-https.htm
http://www.cocoachina.com/ios/20150702/12384.html
http://www.wosign.com/news/ios-app-https.htm
http://www.cocoachina.com/ios/20161207/18308.html
http://edison0663.iteye.com/blog/996526

本页内容由塔灯网络科技有限公司通过网络收集编辑所得，所有资料仅供用户学习参考，本站不拥有所有权，如您认为本网页中由涉嫌抄袭的内容，请及时与我们联系，并提供相关证据，工作人员会在5工作日内联系您，一经查实，本站立刻删除侵权内容。本文链接:https://dengtar.com/20513.html