iOS - SSL 握手 - 客户端证书 - NSURLSession - NSURLErrorDomain 代码=-1200 - 错误链

Question

我正在尝试使用带有 Objective C 的 iPhone 调用网络服务，但出现以下错误:

error -->Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={_kCFStreamErrorCodeKey=-9806, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, NSUnderlyingError=0x600000243690 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, _kCFNetworkCFStreamSSLErrorOriginalValue=-9806, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9806}}, NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., NSErrorFailingURLKey=https://./, NSErrorFailingURLStringKey=https://./, _kCFStreamErrorDomainKey=3}

Info.plist 配置

<dict>
  <key>NSAllowsArbitraryLoads</key>
  <true/>
</dict>

服务器信息:

TLS 1.2
客户端证书身份验证要求 ON
密码列表:

• TLS_RSA_WITH_AES_256_CBC_SHA256
• TLS_RSA_WITH_AES_128_CBC_SHA256
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA
• TLS_RSA_WITH_3DES_EDE_CBC_SHA

注意:在客户端(iOS)和服务器中间添加管理客户端证书的charles代理后，请求成功完成。因此我可以断定我使用的客户端证书是有效的。

关于如何解决这个问题的任何建议或我做错了哪个配置的任何线索？

我的猜测是关于客户端证书配置的，因为我已经使用完全相同的配置和类似的服务(ssl 层/服务器密码)，不需要客户端证书身份验证。

使用代码:

- (void)callWebService:(NSString *)urlStr
             operation:(NSString *)operation
                  body:(NSString *)body
              resolver:(RCTPromiseResolveBlock)resolve
              rejecter:(RCTPromiseRejectBlock)reject {

  NSLog(@"Starting callWebservice");

  NSURL *url = [NSURL URLWithString:urlStr];
  NSMutableURLRequest *theRequest = [NSMutableURLRequest requestWithURL:url];
  NSString *msgLength = [NSString stringWithFormat:@"%lu", (unsigned long) [body length]];

  [theRequest addValue:@"text/xml; charset=utf-8" forHTTPHeaderField:@"Content-Type"];
  [theRequest addValue:msgLength forHTTPHeaderField:@"Content-Length"];
  [theRequest addValue:operation forHTTPHeaderField:@"SOAPAction"];
  [theRequest addValue:@"iOS" forHTTPHeaderField:@"User-Agent"];
  [theRequest setHTTPMethod:@"POST"];
  [theRequest setHTTPBody:[body dataUsingEncoding:NSUTF8StringEncoding]];

  NSURLSessionConfiguration *defaultConfigObject = [NSURLSessionConfiguration defaultSessionConfiguration];
  NSURLSession *session = [NSURLSession sessionWithConfiguration: defaultConfigObject
                                                        delegate: self
                                                   delegateQueue: [NSOperationQueue mainQueue]];


  NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:theRequest
                                              completionHandler:^(NSData *responseData, NSURLResponse *response, NSError *error)
                                    {
                                      NSLog(@"Completed request");

                                      if (error != nil) {
                                        NSLog(@"error -->%@", error);
                                        reject(@"Auth error", @"There were authentication errors", error);
                                      } else {
                                        NSString *responseStr = [[NSString alloc] initWithData:responseData encoding:NSUTF8StringEncoding];
                                        NSLog(@"-->%@", responseStr);
                                        resolve(responseStr);
                                      }


                                    }];
  [dataTask resume];

}

- (void)URLSession:(NSURLSession *)session
              task:(NSURLSessionTask *)task
didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge
 completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *credential))completionHandler
{
  NSLog(@"didReceiveChallenge: %@", challenge.protectionSpace.authenticationMethod);

  if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) {

    NSLog(@"challenged for client certificate");

      NSString *sslCertName = @"certificate_name";
      NSString *path2 = [[NSBundle mainBundle] pathForResource:sslCertName ofType:@"p12"];
      NSData *p12data = [NSData dataWithContentsOfFile:path2];

      CFDataRef inP12data = (__bridge CFDataRef) p12data;

      SecIdentityRef myIdentity;
      SecTrustRef myTrust;

      extractIdentityAndTrust(inP12data, &myIdentity, &myTrust);

      SecCertificateRef myCertificate;
      SecIdentityCopyCertificate(myIdentity, &myCertificate);
      const void *certs[] = {myCertificate};
      CFArrayRef certsArray = CFArrayCreate(NULL, certs, 1, NULL);

      CFRelease(myCertificate);

      secureCredential = [NSURLCredential credentialWithIdentity:myIdentity
                                                    certificates:(__bridge NSArray *) certsArray
                                                     persistence:NSURLCredentialPersistencePermanent];

    CFRelease(certsArray);

    [[challenge sender] useCredential:secureCredential forAuthenticationChallenge:challenge];

    completionHandler(NSURLSessionAuthChallengeUseCredential, secureCredential);
  }

  else if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {

    NSLog(@"challenged for server trust");

    [challenge.sender useCredential:[NSURLCredential credentialForTrust: challenge.protectionSpace.serverTrust]
         forAuthenticationChallenge: challenge];

    completionHandler(NSURLSessionAuthChallengeUseCredential,
                      [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust]);
  } else {

    NSLog(@"other challenge");

    if ([challenge previousFailureCount] == 0) {

      [[challenge sender] continueWithoutCredentialForAuthenticationChallenge:challenge];

    } else {

      [[challenge sender] continueWithoutCredentialForAuthenticationChallenge:challenge];
      completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge,nil);
    }

  }
}


OSStatus extractIdentityAndTrust(CFDataRef inP12data, SecIdentityRef *identity, SecTrustRef *trust)
{
  OSStatus securityError = errSecSuccess;

  CFStringRef password = CFSTR("certificate_password");
  const void *keys[] = { kSecImportExportPassphrase };
  const void *values[] = { password };

  CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL);

  CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);

  securityError = SecPKCS12Import(inP12data, options, &items);

  if (securityError == 0) {
    CFDictionaryRef myIdentityAndTrust = CFArrayGetValueAtIndex(items, 0);
    const void *tempIdentity = NULL;
    tempIdentity = CFDictionaryGetValue(myIdentityAndTrust, kSecImportItemIdentity);
    *identity = (SecIdentityRef)tempIdentity;
    const void *tempTrust = NULL;
    tempTrust = CFDictionaryGetValue(myIdentityAndTrust, kSecImportItemTrust);
    *trust = (SecTrustRef)tempTrust;
  }

  if (options) {
    CFRelease(options);
  }

  return securityError;
}

<罢工>编辑额外信息

经过一些 wireshark 调查后，iOS 似乎发送了两次客户端证书并且服务器关闭了连接。

尝试了此处指定的解决方案: http://oso.com.pl/?p=207&lang=en但它破坏了我所有的代码

Answer 1

目前的解决方案

比较成功请求(android)和 iOS 失败请求之间的 wireshark 数据包后，我注意到 iOS 单独发送客户端证书，而 Android 和 Charles Proxy 发送客户端证书完整链。

我仍在调查完整链未在 iOS 上发送的原因。可能是因为它不信任签署客户端证书的中间证书和根证书？

无论如何，我通过使用以下代码敲击发送的链，设法让 SSL 握手在 iOS 上工作:

  NSString *sslCertName = @"teste_webservices";
  NSString *path2 = [[NSBundle mainBundle] pathForResource:sslCertName ofType:@"p12"];
  NSData *p12data = [NSData dataWithContentsOfFile:path2];

  CFDataRef inP12data = (__bridge CFDataRef) p12data;

  SecIdentityRef myIdentity;
  SecTrustRef myTrust;

  extractIdentityAndTrust(inP12data, &myIdentity, &myTrust);


  NSData *ca1CertData = [NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"ca1" ofType:@"cer"]];
  SecCertificateRef ca1CertRef = SecCertificateCreateWithData(kCFAllocatorDefault, (CFDataRef) ca1CertData);
  NSData *rootCertData = [NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"rootCa" ofType:@"cer"]];
  SecCertificateRef rootCertRef = SecCertificateCreateWithData(kCFAllocatorDefault, (CFDataRef) rootCertData);


  SecCertificateRef myCertificate;
  SecIdentityCopyCertificate(myIdentity, &myCertificate);
  const void *certs[] = {ca1CertRef, rootCertRef};

  CFArrayRef certsArray = CFArrayCreate(NULL, certs, 2, NULL);

  CFRelease(myCertificate);

  secureCredential = [NSURLCredential credentialWithIdentity:myIdentity
                                                certificates:(__bridge NSArray *) certsArray
                                                 persistence:NSURLCredentialPersistencePermanent];