macos - SecItemCopyMatching 不返回系统根证书

Question

我想在运行时将 OSX/iOS 证书导入到 OpenSSL 上下文中。为此，我使用带有以下代码的 SecItemCopyMatching 从操作系统钥匙串(keychain)中检索证书:

CFMutableDictionaryRef attrDict = CFDictionaryCreateMutable(NULL, 4, NULL, NULL);
CFDictionaryAddValue(attrDict, kSecClass, kSecClassCertificate);        
CFDictionaryAddValue(attrDict, kSecReturnRef, kCFBooleanTrue);
CFDictionaryAddValue(attrDict, kSecMatchLimit, kSecMatchLimitAll);
CFDictionaryAddValue(attrDict, kSecMatchTrustedOnly, kCFBooleanTrue );

res = SecItemCopyMatching(attrDict, (CFTypeRef*)&certlist);

这似乎返回了用户和系统证书，但它并没有返回钥匙串(keychain)中“System Roots”的内容。我怎样才能取回这些井？

Answer 1

我遇到了同样的问题，这是我找到的解决方案:手动打开 System Roots 钥匙串(keychain)并将其添加到查询的搜索列表中，如下所示:

SecKeychainRef systemRoots = NULL;
OSStatus kcStatus = SecKeychainOpen("/System/Library/Keychains/SystemRootCertificates.keychain", &systemRoots);

CFArrayRef currentSearchList;
SecKeychainCopySearchList(&currentSearchList);
CFMutableArrayRef newSearchList = CFArrayCreateMutableCopy(NULL, 5, currentSearchList);
CFRelease(currentSearchList);
if (!kcStatus) {
    CFArrayAppendValue(newSearchList, systemRoots);
}

CFMutableDictionaryRef attrDict = CFDictionaryCreateMutable(NULL, 5, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
CFDictionaryAddValue(attrDict, kSecMatchSearchList, newSearchList); // this is the important part