iOS-Network-Https

参考文章:
http://www.ruanyifeng.com/blog/2014/02/ssl_tls.html
http://www.ruanyifeng.com/blog/2014/09/illustration-ssl.html
//www.greatytc.com/p/20d5fb4cd76d
双向验证:
http://blog.csdn.net/codingfire/article/details/53419521
http://m.ithao123.cn/content-10472230.html
OpenSSL:
https://www.openssl.org/docs/man1.0.2/
http://shjia.blog.51cto.com/2476475/1427138

通篇看完觉得一张图解释Https很🐂。

注意:

  1. 证书和服务器需要满足Requirements for Connecting Using ATS的条件。
  2. 保证1满足。

NSURLConnection-两种方式实现 - 客户端验证服务器

其他的如NSURLSession 调用方式和位置不同,原理一样

- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
    NSLog(@"authenticatemethod:%@",challenge.protectionSpace.authenticationMethod);
    BOOL userJustCheckCertificateSame = NO;
    {
        if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
        NSMutableArray *certificates = [NSMutableArray array];
        NSData*caCert =[NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"new_cacert" ofType:@"cer"]];
        NSData*serverCert =[NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"new_server" ofType:@"cer"]];
        if (userJustCheckCertificateSame) {
            [certificates addObject:caCert];
            [certificates addObject:serverCert];
            [self serverTrustjustCheckCertificateSame:challenge pinCertificates:certificates];
        }else{
            SecCertificateRef caCertRef = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)caCert);
            SecCertificateRef serverCertRef = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)serverCert);
            [certificates addObject:(__bridge_transfer id)caCertRef];
            [certificates addObject:(__bridge_transfer id)serverCertRef];
            [self serverTrustSystemMethod:challenge pinCertificates:certificates];
        }
            
        }else if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) {
            //暂时不做client 验证
            [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
//            NSData*certData =[NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"old_client" ofType:@"cer"]];
//            [self addCertToKeychain:certData];
//            NSURLCredential *credential = [self getClientCertFromKeychain];
//            [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
        }else{
            [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
        }
    }
}

// 如果server 返回的证书链 里面有一个在local 证书集合里面,即可认为合法
- (void)serverTrustjustCheckCertificateSame:(NSURLAuthenticationChallenge *)challenge pinCertificates:(NSMutableArray *)pinCertificates{
    SecTrustRef serverTrust = challenge.protectionSpace.serverTrust;
    if ([self localCaInServerChainList:serverTrust pinCertificates:pinCertificates]) {
        NSURLCredential *cred = [NSURLCredential credentialForTrust:serverTrust];
        [challenge.sender useCredential:cred forAuthenticationChallenge:challenge];
    }else{
        [challenge.sender cancelAuthenticationChallenge:challenge];
    }
}

- (BOOL)localCaInServerChainList:(SecTrustRef)serverTrust pinCertificates:(NSMutableArray *)pinCertificates{
    CFIndex certificateCount = SecTrustGetCertificateCount(serverTrust);
    for (CFIndex i = 0; i < certificateCount; i++) {
        SecCertificateRef certificate = SecTrustGetCertificateAtIndex(serverTrust, i);
        NSData *trustChainCertificate = (__bridge_transfer NSData *)SecCertificateCopyData(certificate);
        if ([pinCertificates containsObject:trustChainCertificate]) {
            return YES;
        }
    }
    return NO;
}

// 调用系统方法
- (void)serverTrustSystemMethod:(NSURLAuthenticationChallenge *)challenge pinCertificates:(NSMutableArray *)pinCertificates{
    //1)获取trust object
    SecTrustRef trust = challenge.protectionSpace.serverTrust;
    SecTrustResultType result;
    
    NSMutableArray *policies = [NSMutableArray array];
    // BasicX509 不验证域名是否相同(我们用的IP)
    SecPolicyRef policy = SecPolicyCreateBasicX509();
    [policies addObject:(__bridge_transfer id)policy];
    SecTrustSetPolicies(trust, (__bridge CFArrayRef)policies);
    
    //注意:添加自己的证书作为可信列表
    SecTrustSetAnchorCertificates(trust, (__bridge CFArrayRef)pinCertificates);
    
    //禁用系统可信列表
    //SecTrustSetAnchorCertificatesOnly(trust, false);
    
    //2)SecTrustEvaluate会查找前面SecTrustSetAnchorCertificates设置的证书或者系统默认提供的证书,对trust进行验证
    OSStatus status = SecTrustEvaluate(trust, &result);
    if (status == errSecSuccess &&
        (result == kSecTrustResultProceed ||
         result == kSecTrustResultUnspecified))
    {
        //3)验证成功,生成NSURLCredential凭证cred,告知challenge的sender使用这个凭证来继续连接
        NSURLCredential *cred = [NSURLCredential credentialForTrust:trust];
        [challenge.sender useCredential:cred forAuthenticationChallenge:challenge];
    } else {
        //5)验证失败,取消这次验证流程
        [challenge.sender cancelAuthenticationChallenge:challenge];
    }
}

NSURLConnection -服务器验证客户端


所有参考链接:
http://www.cnblogs.com/qiyer/p/4871421.html
http://m.ithao123.cn/content-10472230.html
http://oncenote.com/2014/10/21/Security-1-HTTPS/
http://oncenote.com/2015/09/16/Security-2-HTTPS2/#verify_safely
http://www.cnblogs.com/interdrp/p/4881116.html
http://www.cnblogs.com/pixy/p/4722381.html
http://www.cnblogs.com/JeffreySun/archive/2010/06/24/1627247.html
//www.greatytc.com/p/2927ca2b3719
http://www.ruanyifeng.com/blog/2014/09/illustration-ssl.html
http://www.ruanyifeng.com/blog/2014/02/ssl_tls.html
https://zh.wikipedia.org/wiki/%E8%BF%AA%E8%8F%B2-%E8%B5%AB%E7%88%BE%E6%9B%BC%E5%AF%86%E9%91%B0%E4%BA%A4%E6%8F%9B
http://www.cnblogs.com/oc-bowen/p/5896041.html
http://www.cnblogs.com/jukan/p/5527922.html
http://www.cnblogs.com/guogangj/p/4118605.html
http://blog.csdn.net/linda1000/article/details/8676330
http://blog.sina.com.cn/s/blog_a9303fd90101jmtx.html
https://tools.ietf.org/html/rfc5246#section-7.3
https://developer.apple.com/library/prerelease/content/documentation/Security/Conceptual/CertKeyTrustProgGuide/revisionHistory.html#//apple_ref/doc/uid/TP40001358-CH206-TPXREF101
https://developer.apple.com/library/prerelease/content/technotes/tn2326/_index.html
https://developer.apple.com/library/content/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW57
https://developer.apple.com/library/content/documentation/Security/Conceptual/CertKeyTrustProgGuide/revisionHistory/revisionHistory.html#//apple_ref/doc/uid/TP40001358-CH206-TPXREF101
https://developer.apple.com/library/content/technotes/tn2232/_index.html#//apple_ref/doc/uid/DTS40012884-CH1-SECBASICTRUSTCUSTOMIZATION
//www.greatytc.com/p/2542c95fb023
http://www.cnblogs.com/longshiyVip/p/5080917.html
//www.greatytc.com/p/e767a4e9252e
http://www.cnblogs.com/hyddd/archive/2009/01/07/1371292.html
https://developer.apple.com/library/content/qa/qa1727/_index.html
https://developer.apple.com/reference/security

最后编辑于
©著作权归作者所有,转载或内容合作请联系作者
平台声明:文章内容(如有图片或视频亦包括在内)由作者上传并发布,文章内容仅代表作者本人观点,简书系信息发布平台,仅提供信息存储服务。

推荐阅读更多精彩内容

  • 10点半睡,6点半起,2+6.5=8.5小时有核心技术的人,才能活到最后。 iOS 阅读整理在sourcetree...
    士梦阅读 3,086评论 0 18
  • 前端知识体系http://www.cnblogs.com/sb19871023/p/3894452.html 前端...
    秋风喵阅读 12,607评论 7 163
  • 一层一层把地基搭好,现在终于可以把商品拿出来show了。顾客买东西,解决的就是信任和价值。展示商品就是像顾客...
    上帝爱非洲阅读 386评论 2 3
  • 面试的时候,是自尊和自傲遭到碾压和粉碎最彻底的时候。面试官的一个个问题,尖锐到像一把针,毫不避讳的刺过你的心脏,刺...
    小沙发阅读 399评论 0 0
  • 被游戏带上分感动 就很开心 没有说晚安 但也没差 有一个小尴尬 还好没在意 确认之后是了解 没关系的 我先藏着...
    蓝桉_屿阅读 228评论 0 0