ios - 带 SSL 固定的 AFHTTPRequestOperation 不起作用

Question

我正在为我的 iPhone 应用程序 (Objective-C) 使用 AFHTTPRequestOperation。我需要为我的应用启用 SSL 固定。

但是，无论我包含在我的应用程序包中的证书是正确的还是错误的，调用我的 API 总是成功的。

如果我在我的应用程序中固定的证书是错误的证书，我的服务器 API 的调用是否应该失败？

这是我在应用程序中的代码:

- (AFHTTPRequestOperation *)HTTPRequestOperationWithRequest:(NSURLRequest *)request
                                                    success:(void (^)(AFHTTPRequestOperation *operation, id responseObject))success
                                                    failure:(void (^)(AFHTTPRequestOperation *operation, NSError *error))failure{
    AFHTTPRequestOperation *operation = [[AFHTTPRequestOperation alloc] initWithRequest:request];

    operation.responseSerializer = self.responseSerializer;
    operation.shouldUseCredentialStorage = self.shouldUseCredentialStorage;
    operation.credential = self.credential;
    //operation.securityPolicy = self.securityPolicy;

    AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
    NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"wrong_cert" ofType:@"cer"];
    NSData *certData = [NSData dataWithContentsOfFile:cerPath];
    [securityPolicy setAllowInvalidCertificates:NO];
    [securityPolicy setValidatesDomainName:YES];
    [securityPolicy setPinnedCertificates:@[certData]];
    [operation setSecurityPolicy:securityPolicy];

    [operation setCompletionBlockWithSuccess:success failure:failure];
    operation.completionQueue = self.completionQueue;
    operation.completionGroup = self.completionGroup;

    return operation;

}

请指教。谢谢。

Answer 1

我使用 AFNetworking 成功实现了 SSL Pinning。在进行测试之前，请确保您的证书有效。看下面的代码片段。

AFHTTPRequestOperationManager *manager = [AFHTTPRequestOperationManager sharedManager];
    manager.responseSerializer = [AFJSONResponseSerializer serializer];
    manager.responseSerializer.acceptableContentTypes = [NSSet setWithObject:@"text/html"];
    AFHTTPRequestOperation *post = [manager POST:[NSString stringWithFormat:@"%@",url] parameters:nil success:^(AFHTTPRequestOperation *operation, id responseObject) {
        NSLog(@"JSON: %@", responseObject);

        [delegate requestCompleted:responseObject];
    } failure:^(AFHTTPRequestOperation *operation, NSError *error) {

        if([error.domain isEqualToString:@"NSURLErrorDomain"] && error.code == -1012){
            //SSL Pinning request failed

        } else if (!operation.cancelled) {

        }
    }];

    [post start];