AFNetworking3.0 Https P12证书

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

最近服务器由原来的ice中间件改为https。方便了和服务器交互时不用自己aes加密了。

-之前服务器人员和我（IOS）都没有使用过https，所以https跑不通很难说是服务器没有配置好还是IOS这边网络没有写好。

-开始服务器提供了两个证书（自签名）。一个.cer一个p12.

导入AFNetworking 之后按照其他资料提供的方法很简单。

NSString *urlString = @"https://xxxxx网址";
NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"https" ofType:@"cer"]; //获取cer证书
NSData * certData =[NSData dataWithContentsOfFile:cerPath];
NSSet * certSet = [[NSSet alloc] initWithObjects:certData, nil];
AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate]; //采用证书验证模式
// 是否允许,NO-- 不允许无效的证书 YES-- 允许无效的证书（因为用的是自签名证书这里设置为YES，没有经过CA认证）
[securityPolicy setAllowInvalidCertificates:YES];
// 设置证书
[securityPolicy setPinnedCertificates:certSet];
AFHTTPSessionManager *manager = [AFHTTPSessionManager manager];
manager.securityPolicy = securityPolicy;
manager.responseSerializer = [AFHTTPResponseSerializer serializer];
// request 这里开始GET请求
[manager GET:urlString parameters:nil progress:^(NSProgress * progress){
} success:^(NSURLSessionDataTask *task, id responseObject) {
NSLog(@"OK === %@",array); //请求成功
} failure:^(NSURLSessionDataTask *task, NSError *error) {
NSLog(@"error ==%@",error.description); //请求失败
}];

-经过我一番研究，太TM简单了啊添加几个参数就行了。

-谁知道按照这样怎么也跑不通。调试了半天，都跑到afnetworking源码里面去查了，好像查出来证书验证通过不了。AFSecurityPolicy.h这个文件里面的 AFServerTrustIsValid方法就是通过不了，里面有个枚举值

代表证书验证的结果

typedef uint32_t SecTrustResultType;
enum {
    kSecTrustResultInvalid = 0,
    kSecTrustResultProceed = 1,
    kSecTrustResultConfirm SEC_DEPRECATED_ATTRIBUTE = 2,
    kSecTrustResultDeny = 3,
    kSecTrustResultUnspecified = 4,
    kSecTrustResultRecoverableTrustFailure = 5,
    kSecTrustResultFatalTrustFailure = 6,
    kSecTrustResultOtherError = 7
};

具体枚举值什么意思直接百度就能搜出来。验证结果一直是kSecTrustResultRecoverableTrustFailure，5.意思就是证书验证失败。

-开始怀疑服务器给的.cer证书有问题。

-查了几天资料，找到一个只用p12证书的资料。（因为搜索资料时好多人说了证书的问题，所以怀疑和cer证书转换的格式或者编码有关，所以决定用原始的p12证书）

-结果用原始的p12证书和原生的网络跑通了。用afnetworking的话资料都是用了cer，加上cer证书就跑不通。本来决定用原生网络，后来又要封装各种post啊什么的太麻烦了，所以去研究afnetworking和p12证书了。

-最后解决。

-afnetworking的AFURLSessionManager.m类里面的方法

afnetworking源码里面这个方法只有一行代码，把它替换成

- (void)URLSession:(NSURLSession *)session
didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge
completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *credential))completionHandler
{
NSString *method = challenge.protectionSpace.authenticationMethod;
NSLog(@">>>>1 %@", method); if([method isEqualToString:NSURLAuthenticationMethodServerTrust]){ NSString *host = challenge.protectionSpace.host;
NSLog(@">>>>2 %@", host); NSURLCredential *credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust];
completionHandler(NSURLSessionAuthChallengeUseCredential, credential);
return;
} else if([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) { NSString *thePath = [[NSBundle mainBundle] pathForResource:@"client" ofType:@"p12"];
NSData *PKCS12Data = [[NSData alloc] initWithContentsOfFile:thePath];
CFDataRef inPKCS12Data = (CFDataRef)CFBridgingRetain(PKCS12Data);
SecIdentityRef identity; // 读取p12证书中的内容
OSStatus result = [self extractP12Data:inPKCS12Data toIdentity:&identity]; if(result != errSecSuccess){
completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
return;
} SecCertificateRef certificate = NULL;
SecIdentityCopyCertificate(identity, &certificate); const void *certs[] = {certificate};
CFArrayRef certArray = CFArrayCreate(kCFAllocatorDefault, certs, , NULL); NSURLCredential *credential = [NSURLCredential credentialWithIdentity:identity certificates:(NSArray*)CFBridgingRelease(certArray) persistence:NSURLCredentialPersistencePermanent]; completionHandler(NSURLSessionAuthChallengeUseCredential, credential);
}
}

这个是收到验证证书时候的回调。

再在这个类里面添加一个方法

-(OSStatus) extractP12Data:(CFDataRef)inP12Data toIdentity:(SecIdentityRef*)identity {

    OSStatus securityError = errSecSuccess;

    CFStringRef password = CFSTR("yaoguang123");
    const void *keys[] = { kSecImportExportPassphrase };
    const void *values[] = { password };

    CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL);

    CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
    securityError = SecPKCS12Import(inP12Data, options, &items);

    if (securityError == 0) {
        CFDictionaryRef ident = (CFDictionaryRef)CFArrayGetValueAtIndex(items,0);
        const void *tempIdentity = NULL;
        tempIdentity = CFDictionaryGetValue(ident, kSecImportItemIdentity);
        *identity = (SecIdentityRef)tempIdentity;
    }

    if (options) {
        CFRelease(options);
    }

    //    NSLog(@">>>>>>>> inP12Data = %@", inP12Data);
    //    NSLog(@">>>>>>>> identity = %@", identity);

    return securityError;
}

之后想要获取数据，不用设置验证模式啊什么的，直接调用

- (void)testHttps { manager = [AFHTTPSessionManager manager]; [manager GET:@"https://www.iyaoguang.com:8443/App/login?phone=123&password=123" parameters:nil progress:nil success:^(NSURLSessionDataTask * _Nonnull task, id _Nullable responseObject) {
NSLog(@"???????????? %@",responseObject);
} failure:^(NSURLSessionDataTask * _Nullable task, NSError * _Nonnull error) {
NSLog(@"?????????? %@",error);
}];}

成功！