ios - 如何为 AFNetworking 创建 .cer 文件以在 iOS 应用程序包中使用

Question

我一直在整个网络上看到关于 .cer 文件是什么以及如何生成它以便应用程序可以通过 https 与服务器正确通信的不连贯帐户。

引用this来源，一个人说:

1) You now need .cer files in your bundle for all certificates in the chain. So, at least, two certificate files must be present (your certificate and the root CA). In our case, we needed an intermediate as well.

2) These certificates must be in a particular order. Specifically, the certificate that certifies the host that you are communicating with must be first in the list of pinned certificates/keys. It doesn't look like the order of the rest of them matter. This is because AFSecurityPolicy uses the first object in the array to validate the host name.

3) The host validation fails for wildcard certificates if you are communicating with the root domain. For example, consider a certificate pointed at *.foo.com. If you are communicating with foo.com, the host check will fail because the host component counts will not match. I understand the need for this early optimization, but it fails before it even reaches the logic that specifically handles wildcard domains.

官方文档支持这一点 here .

我想为了生成它，必须将整个证书链的内容按特定顺序放入 .cer 文件中。我记得在某个地方看到过这个帖子，但似乎找不到。

问题是，为 AFNetworking 创建 .cer 文件的无可争辩的方法是什么？

更新:

经过更多研究，在我看来，您只需获取 .crt 文件并对其执行此操作:

openssl x509 -in www.mydomain.com.crt -out www.mydomain.com.cer -outform der

但是，即使在执行此操作并将 .cer 附加到我的应用程序包之后，我仍会在此处收到错误消息:

+ (NSArray *)pinnedPublicKeys {
    static NSArray *_pinnedPublicKeys = nil;
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        NSArray *pinnedCertificates = [self pinnedCertificates];
        NSMutableArray *publicKeys = [NSMutableArray arrayWithCapacity:[pinnedCertificates count]];

    for (NSData *data in pinnedCertificates) {
        SecCertificateRef allowedCertificate = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)data);
        NSParameterAssert(allowedCertificate);

错误出现在最后一行。我想在它尝试分配 allowedCertificate 的前一行中，SecCertificateCreateWithData 具有以下描述:

/*!
    @function SecCertificateCreateWithData
    @abstract Create a certificate given it's DER representation as a CFData.
    @param allocator CFAllocator to allocate the certificate with.
    @param certificate DER encoded X.509 certificate.
    @result Return NULL if the passed-in data is not a valid DER-encoded
    X.509 certificate, return a SecCertificateRef otherwise.
*/

很明显它返回一个 NULL，但我不知道为什么。我的特定证书格式正确。但是，我确实注意到 pinnedCertificates 数组中还有其他“证书”，但我不知道它们是从哪里获得的。我似乎也找不到它们或将它们打印出来。据我所知，我在应用程序包中只有一个，但它似乎显示的不止于此。

最后一行断言产生的错误是:

*** 由于未捕获的异常“NSInternalInconsistencyException”而终止应用程序，原因:“无效参数不满足:allowedCertificate”

Answer 1

假设您正在使用 AFNetworking 2.5，步骤如下:

• 在您的服务器上安装有效证书

• 创建 .cer 文件 openssl x509 -in www_yourdomain_com.crt -out www_yourdomain_com.cer -outform der

• 将 .cer 文件添加到应用程序项目。重要提示:切勿将私钥添加到您的项目!!!

• 设置 AFNetworking 安全策略

  - (AFSecurityPolicy *)securityPolicy {
     AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
     [securityPolicy setAllowInvalidCertificates:NO];
     [securityPolicy setValidatesDomainName:YES];
     return securityPolicy;
  }
  

• 在进行网络调用时设置网络管理员策略

   AFHTTPRequestOperationManager *manager = [AFHTTPRequestOperationManager manager];
   [manager setSecurityPolicy:[self securityPolicy]];
  

如果您使用 policyWithPinningMode:pinningMode 方法创建安全策略 AFNetworking 会自动固定它们，则无需手动加载 .cer 文件。