設(shè)置p12證書的源頭

然后subject里面和設(shè)置CA證書一樣。

p12證書默認(rèn)是一年的，如果感覺短的話 ? 可以在Extensions中設(shè)置時(shí)間。

然后把P12證書放到客戶端項(xiàng)目里。

五、iOS端的https雙向適配

AFN的https的雙向適配2.x和3.0不一樣，先說3.0

客戶端認(rèn)證服務(wù)端,

shareManager = [AFHTTPSessionManager manager];

shareManager.securityPolicy = [self customSecurityPolicyWithCerName:HPWalletServerCerName];//調(diào)用方法

//客戶端認(rèn)證服務(wù)端的方法

+ (AFSecurityPolicy *)customSecurityPolicyWithCerName:(NSString *)cerName{

//導(dǎo)入證書路徑

NSString *cerPath = [[NSBundle mainBundle] pathForResource:cerName ofType:@""];

//加載證書

NSData *cerData = [NSData dataWithContentsOfFile:cerPath];

NSSet *certSet = [NSSet setWithObject:cerData];

//使用AFSSLPinningModeCertificate證書驗(yàn)證模式

AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate withPinnedCertificates:certSet];

//allowInvalidCertificates 是否允許無效證書（也就是自建的證書），默認(rèn)為NO

//如果是需要驗(yàn)證自建證書，需要設(shè)置為YES

securityPolicy.allowInvalidCertificates = NO;

//是否需要驗(yàn)證域名，默認(rèn)為YES

//假如證書的域名與你請(qǐng)求的域名不一致，需把該項(xiàng)設(shè)置為NO；如設(shè)成NO的話，即服務(wù)器使用其他可信任機(jī)構(gòu)頒發(fā)的證書，也可以建立連接，這個(gè)非常危險(xiǎn)，建議打開。

//置為NO，主要用于這種情況：客戶端請(qǐng)求的是子域名，而證書上的是另外一個(gè)域名。因?yàn)镾SL證書上的域名是獨(dú)立的，假如證書上注冊(cè)的域名是www.google.com，那么mail.google.com是無法驗(yàn)證通過的；當(dāng)然，有錢可以注冊(cè)通配符的域名*.google.com，但這個(gè)還是比較貴的。

//如置為NO，建議自己添加對(duì)應(yīng)域名的校驗(yàn)邏輯。

securityPolicy.validatesDomainName = YES;

return securityPolicy;

}

重寫AFN的方法 ?來讓服務(wù)器認(rèn)證客戶端

{//新的https

shareManager.securityPolicy = [self customSecurityPolicyWithCerName:HPWalletServerCerName];

//客戶端請(qǐng)求驗(yàn)證，重寫setSessionDidReceiveAuthenticationChallengeBlock方法

[shareManager setSessionDidReceiveAuthenticationChallengeBlock:^NSURLSessionAuthChallengeDisposition(NSURLSession *session, NSURLAuthenticationChallenge *challenge, NSURLCredential *__autoreleasing *_credential) {

NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengePerformDefaultHandling;

__autoreleasing NSURLCredential *credential = nil;

if([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {

if([shareManager.securityPolicy evaluateServerTrust:challenge.protectionSpace.serverTrust forDomain:challenge.protectionSpace.host]) {

credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust];

if(credential) {

disposition =NSURLSessionAuthChallengeUseCredential;

} else {

disposition =NSURLSessionAuthChallengePerformDefaultHandling;

}

} else {

disposition = NSURLSessionAuthChallengeCancelAuthenticationChallenge;

}

} else {

// client authentication

SecIdentityRef identity = NULL;

SecTrustRef trust = NULL;

NSString *p12 = [[NSBundle mainBundle] pathForResource:@"p12文件的名字" ofType:@"p12"];

NSFileManager *fileManager =[NSFileManager defaultManager];

if(![fileManager fileExistsAtPath:p12]) {

NSLog(@"hpwallet-client.p12:not exist");

} else {

NSData *PKCS12Data = [NSData dataWithContentsOfFile:p12];

if ([[self class] extractIdentity:&identity andTrust:&trust fromPKCS12Data:PKCS12Data]) {

SecCertificateRef certificate = NULL;

SecIdentityCopyCertificate(identity, &certificate);

const void *certs[] = {certificate};

CFArrayRef certArray =CFArrayCreate(kCFAllocatorDefault, certs,1,NULL);

credential =[NSURLCredential credentialWithIdentity:identity certificates:(__bridge ?NSArray*)certArray persistence:NSURLCredentialPersistencePermanent];

disposition =NSURLSessionAuthChallengeUseCredential;

}

}

}

*_credential = credential;

return disposition;

}];

}

+ (BOOL)extractIdentity:(SecIdentityRef *)outIdentity andTrust:(SecTrustRef *)outTrust fromPKCS12Data:(NSData *)inPKCS12Data {

OSStatus securityError = errSecSuccess;

//client certificate password

NSDictionary*optionsDictionary = [NSDictionary dictionaryWithObject:@“p12的密碼“ forKey:(__bridge id)kSecImportExportPassphrase];

CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);

securityError = SecPKCS12Import((__bridge CFDataRef)inPKCS12Data,(__bridge CFDictionaryRef)optionsDictionary,&items);

if(securityError == 0) {

CFDictionaryRef myIdentityAndTrust =CFArrayGetValueAtIndex(items,0);

const void*tempIdentity =NULL;

tempIdentity= CFDictionaryGetValue (myIdentityAndTrust,kSecImportItemIdentity);

*outIdentity = (SecIdentityRef)tempIdentity;

const void*tempTrust =NULL;

tempTrust = CFDictionaryGetValue(myIdentityAndTrust,kSecImportItemTrust);

*outTrust = (SecTrustRef)tempTrust;

} else {

NSLog(@"Failedwith error code %d",(int)securityError);

return NO;

}

return YES;

}

AFN2.x適配

客戶端認(rèn)證服務(wù)器

manage.securityPolicy = [HttpServiceAFNetworkImp customSecurityPolicy];

+ (AFSecurityPolicy *)customSecurityPolicy

{

NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"服務(wù)器.cer證書的名字"ofType:@"der"];

NSData *cerData = [NSData dataWithContentsOfFile:cerPath];

AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];

//allowInvalidCertificates 是否允許無效證書（也就是自建的證書），默認(rèn)為NO

//如果是需要驗(yàn)證自建證書，需要設(shè)置為YES

securityPolicy.allowInvalidCertificates = NO;

//是否需要驗(yàn)證域名，默認(rèn)為YES

//假如證書的域名與你請(qǐng)求的域名不一致，需把該項(xiàng)設(shè)置為NO；如設(shè)成NO的話，即服務(wù)器使用其他可信任機(jī)構(gòu)頒發(fā)的證書，也可以建立連接，這個(gè)非常危險(xiǎn)，建議打開。

//置為NO，主要用于這種情況：客戶端請(qǐng)求的是子域名，而證書上的是另外一個(gè)域名。因?yàn)镾SL證書上的域名是獨(dú)立的，假如證書上注冊(cè)的域名是www.google.com，那么mail.google.com是無法驗(yàn)證通過的；當(dāng)然，有錢可以注冊(cè)通配符的域名*.google.com，但這個(gè)還是比較貴的。

//如置為NO，建議自己添加對(duì)應(yīng)域名的校驗(yàn)邏輯。

securityPolicy.validatesDomainName = YES;

//放入證書

securityPolicy.pinnedCertificates = @[cerData];

return securityPolicy;

}

服務(wù)器認(rèn)證客戶端，這個(gè)要把AFN的AFURLConnectionOperation.m文件中 ?- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge方法替換掉 ?替換成

- (void)connection:(NSURLConnection *)connection

willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge

{

NSString *thePath = [[NSBundle mainBundle] pathForResource:@"client" ofType:@"p12"];

//倒入證書 ? ? ? NSLog(@"thePath===========%@",thePath);

NSData *PKCS12Data = [[NSData alloc] initWithContentsOfFile:thePath];

CFDataRef inPKCS12Data = (__bridge CFDataRef)PKCS12Data;

SecIdentityRef identity = NULL;

// extract the ideneity from the certificate

[self extractIdentity :inPKCS12Data toIdentity:&identity];

SecCertificateRef certificate = NULL;

SecIdentityCopyCertificate (identity, &certificate);

const void *certs[] = {certificate};

// ? ? ? ? ? ? ? ? ? ? ? ?CFArrayRef certArray = CFArrayCreate(kCFAllocatorDefault, certs, 1, NULL);

// create a credential from the certificate and ideneity, then reply to the challenge with the credential

//NSLog(@"identity=========%@",identity);

NSURLCredential *credential = [NSURLCredential credentialWithIdentity:identity certificates:nil persistence:NSURLCredentialPersistencePermanent];

// ? ? ? ? ? credential = [NSURLCredential credentialWithIdentity:identity certificates:(__bridge NSArray*)certArray persistence:NSURLCredentialPersistencePermanent];

[challenge.sender useCredential:credential forAuthenticationChallenge:challenge];

}

并添加下面的方法

- (OSStatus)extractIdentity:(CFDataRef)inP12Data toIdentity:(SecIdentityRef*)identity {

OSStatus securityError = errSecSuccess;

CFStringRef password = CFSTR("證書密碼");

const void *keys[] = { kSecImportExportPassphrase };

const void *values[] = { password };

CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL);

CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);

securityError = SecPKCS12Import(inP12Data, options, &items);

if (securityError == 0)

{

CFDictionaryRef ident = CFArrayGetValueAtIndex(items,0);

const void *tempIdentity = NULL;

tempIdentity = CFDictionaryGetValue(ident, kSecImportItemIdentity);

*identity = (SecIdentityRef)tempIdentity;

}

if (options) {

CFRelease(options);

}

return securityError;

}

本頁內(nèi)容由塔燈網(wǎng)絡(luò)科技有限公司通過網(wǎng)絡(luò)收集編輯所得，所有資料僅供用戶學(xué)習(xí)參考，本站不擁有所有權(quán)，如您認(rèn)為本網(wǎng)頁中由涉嫌抄襲的內(nèi)容，請(qǐng)及時(shí)與我們聯(lián)系，并提供相關(guān)證據(jù)，工作人員會(huì)在5工作日內(nèi)聯(lián)系您，一經(jīng)查實(shí)，本站立刻刪除侵權(quán)內(nèi)容。本文鏈接:http://www.juherenli.com/20389.html