macos - OS X 如何检查证书是否为签名

Question

有没有一种方法可以使用类似于 OpenSSL X509_verify 的 SecureTransport API 检查证书是否由给定的根证书签名？

Answer 1

在 OS X 上，创建和操作证书的 API 是 Certificate, Key, and Trust Services :

Certificate, Key, and Trust Services is a C API for managing certificates, public and private keys, symmetric keys, and trust policies in iOS and OS X. You can use these services in your app to:

• Create certificates and asymmetric keys
• Add certificates and keys to keychains, remove them from keychains, and use keys to encrypt and decrypt data
• Retrieve information about a certificate, such as the private key associated with it, the owner, and so on
• Convert certificates to and from portable representations
• Create and manipulate trust policies and evaluate a specific certificate using a specified set of trust policies
• Add anchor certificates

例如:

• > SecTrustCreateWithCertificates - 创建基于证书和策略的信任管理对象。
• > SecTrustEvaluate - 评估对指定证书和策略的信任。
• > SecTrustSetAnchorCertificates - 设置评估信任管理对象时使用的 anchor 证书。