在info.plist刪掉或改為NO

單向認證示例代碼

+ (AFSecurityPolicy *)customSecurityPolicy { // 先導入證書，在這加證書，一般情況適用于單項認證 // 證書的路徑 NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"xxx" ofType:@"cer"];NSData *cerData = [NSData dataWithContentsOfFile:cerPath];if (cerData == nil) { return nil; } NSSet *setData = [NSSet setWithObject:cerData]; //AFSSLPinningModeCertificate 使用證書驗證模式 AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];// allowInvalidCertificates 是否允許無效證書(也就是自建的證書)，默認為NO // 如果是需要驗證自建證書，需要設置為YES securityPolicy.allowInvalidCertificates = YES;// validatesDomainName 是否需要驗證域名，默認為YES; // 假如證書的域名與你請求的域名不一致，需要把該項設置為NO；如設成NO的話，即服務器使用其他可信任機構頒發的證書，也可以建立連接，這個非常危險，建議打開。 // 設置為NO，主要用于這種情況：客戶端請求的事子域名，而證書上的是另外一個域名。因為SSL證書上的域名是獨立的，假如證書上注冊的域名是www.google.com,那么mail.google.com是無法驗證通過的；當然有錢可以注冊通配符的域名*.google.com，但這個還是比較貴的。 // 如設置為NO，建議自己添加對應域名的校驗邏輯。 securityPolicy.validatesDomainName = NO;[securityPolicy setPinnedCertificates:setData];return securityPolicy; } 

然后在相應位置加入

[manager setSecurityPolicy:[self customSecurityPolicy]]; 

AFNetworking定義了三種SSLpinningmode：
AFSSLPinningModeNone: 代表客戶端無條件地信任服務器端返回的證書

AFSSLPinningModePublicKey : 代表客戶端會將服務器端返回的證書與本地保存的證書PublicKey的部分進行校驗;如果正確，才繼續進行。

AFSSLPinningModeCertificate: 代表客戶端會將服務器端返回的證書和本地保存的證書中的所有內容，包括PublicKey和證書部分，全部進行校驗;如果正確，才繼續進行。

雙向認證示例代碼

http://blog.csdn.net/guobing19871024/article/details/53841373
http://blog.csdn.net/jerryvon/article/details/8548802

//校驗證書 + (void)checkCredential:(AFURLSessionManager *)manager { [manager setSessionDidBecomeInvalidBlock:^(NSURLSession * _Nonnull session, NSError * _Nonnull error) { }]; __weak typeof(manager)weakManager = manager; [manager setSessionDidReceiveAuthenticationChallengeBlock:^NSURLSessionAuthChallengeDisposition(NSURLSession*session, NSURLAuthenticationChallenge *challenge, NSURLCredential *__autoreleasing*_credential) { NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengePerformDefaultHandling; __autoreleasing NSURLCredential *credential =nil; NSLog(@"authenticationMethod=%@",challenge.protectionSpace.authenticationMethod); //判斷是核驗客戶端證書還是服務器證書 if([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) { // 基于客戶端的安全策略來決定是否信任該服務器，不信任的話，也就沒必要響應挑戰 if([weakManager.securityPolicy evaluateServerTrust:challenge.protectionSpace.serverTrust forDomain:challenge.protectionSpace.host]) { // 創建挑戰證書（注：挑戰方式為UseCredential和PerformDefaultHandling都需要新建挑戰證書） NSLog(@"serverTrust=%@",challenge.protectionSpace.serverTrust); credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust]; // 確定挑戰的方式 if (credential) { //證書挑戰設計policy,none，則跑到這里 disposition = NSURLSessionAuthChallengeUseCredential; } else { disposition = NSURLSessionAuthChallengePerformDefaultHandling; } } else { disposition = NSURLSessionAuthChallengeCancelAuthenticationChallenge; } } else { // client authentication SecIdentityRef identity = NULL; SecTrustRef trust = NULL; NSString *p12 = [[NSBundle mainBundle] pathForResource:@"xxx"ofType:@"p12"]; NSFileManager *fileManager =[NSFileManager defaultManager];if(![fileManager fileExistsAtPath:p12]) { NSLog(@"client.p12:not exist"); } else { NSData *PKCS12Data = [NSData dataWithContentsOfFile:p12];if ([self extractIdentity:&identity andTrust:&trust fromPKCS12Data:PKCS12Data]) { SecCertificateRef certificate = NULL; SecIdentityCopyCertificate(identity, &certificate); const void*certs[] = {certificate}; CFArrayRef certArray =CFArrayCreate(kCFAllocatorDefault, certs,1,NULL); credential =[NSURLCredential credentialWithIdentity:identity certificates:(__bridgeNSArray*)certArray persistence:NSURLCredentialPersistencePermanent]; disposition =NSURLSessionAuthChallengeUseCredential; } } } *_credential = credential; return disposition; }]; }//讀取p12文件中的密碼 + (BOOL)extractIdentity:(SecIdentityRef*)outIdentity andTrust:(SecTrustRef *)outTrust fromPKCS12Data:(NSData *)inPKCS12Data { OSStatus securityError = errSecSuccess; //client certificate password NSDictionary *optionsDictionary = [NSDictionary dictionaryWithObject:@"123456" forKey:(__bridge id)kSecImportExportPassphrase];CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL); securityError = SecPKCS12Import((__bridge CFDataRef)inPKCS12Data,(__bridge CFDictionaryRef)optionsDictionary,&items);if(securityError == 0) { CFDictionaryRef myIdentityAndTrust =CFArrayGetValueAtIndex(items,0); const void*tempIdentity =NULL; tempIdentity= CFDictionaryGetValue (myIdentityAndTrust,kSecImportItemIdentity); *outIdentity = (SecIdentityRef)tempIdentity; const void*tempTrust =NULL; tempTrust = CFDictionaryGetValue(myIdentityAndTrust,kSecImportItemTrust); *outTrust = (SecTrustRef)tempTrust; } else { NSLog(@"Failedwith error code %d",(int)securityError); return NO; } return YES; } 

然后在相應位置加入

[manager setSecurityPolicy:[self customSecurityPolicy]]; [self checkCredential:manager];

三、NSURLConnection、NSURLSession適配

http://www.cnblogs.com/lmfboke/p/6232656.html
http://oncenote.com/2014/10/21/Security-1-HTTPS/
http://www.jianshu.com/p/97745be81d64

四、其他

SDWebImage繞過證書驗證去加載圖片

[imageView sd_setImageWithURL:[NSURL URLWithString:urlString] placeholderImage:self.placeholder options:SDWebImageAllowInvalidSSLCertificates]; 

五、部分參考

http://www.jianshu.com/p/72bf60b5f94d
http://www.cnblogs.com/lmfboke/p/6232656.html
http://blog.csdn.net/iostiannan/article/details/53763082
http://www.wosign.com/faq/faq-ios-https.htm
http://www.cocoachina.com/ios/20150702/12384.html
http://www.wosign.com/news/ios-app-https.htm
http://www.cocoachina.com/ios/20161207/18308.html
http://edison0663.iteye.com/blog/996526

本頁內容由塔燈網絡科技有限公司通過網絡收集編輯所得，所有資料僅供用戶學習參考，本站不擁有所有權，如您認為本網頁中由涉嫌抄襲的內容，請及時與我們聯系，并提供相關證據，工作人員會在5工作日內聯系您，一經查實，本站立刻刪除侵權內容。本文鏈接:http://www.juherenli.com/20513.html