ios - 根据自定义 anchor 证书验证证书

Question

我有两个 X509 格式的证书，我想将 certificateA 添加到锚定证书列表中，并仅根据 certificateA 评估 certificateB。我们还假设链中的 certA -> certB，因此 CertA 是受信任的根。

int len = i2d_X509(certificateA, &buf);
if (len > 0) {
  /* Translate the data to a SecCertificateRef */
  CFDataRef data = CFDataCreate(NULL, buf, len);
  SecCertificateRef ref = SecCertificateCreateWithData(NULL, data);
  CFRelease(data);

  if (ref != NULL) {
    /* Add the cert to the array */
    [certs addObject:(__bridge_transfer id)(ref)];
  }
} else {
  return NULL;
}
OPENSSL_free(buf);

/* Get the reference */
CFArrayRef certsRef = (__bridge CFArrayRef)certs;

/* Get the Trust Refs */
NSString *refHostname = [NSString stringWithCString:hostname.c_str() encoding:[NSString defaultCStringEncoding]];
SecPolicyRef policy = SecPolicyCreateSSL(NO, (__bridge CFStringRef) refHostname);

SecTrustRef trustRefA;
OSStatus ret = SecTrustCreateWithCertificates(certsRef, policy, &trustRefA);

我对 certA 和 certB 都这样做，这给了我两个 trustRef。然后将 certificateA 添加到 Anchors 列表中:

  OSStatus ret = SecTrustSetAnchorCertificatesOnly(trustRefA, YES);

稍后，我想做:

  OSStatus ret = SecTrustEvaluate(trustRefB, YES);

这行不通。另外，有没有一种方法可以让我使用 SecTrustEvaluate，并且只针对 CertA anchor 进行评估。

有什么方法可以将单个 anchor 设置为默认证书以进行验证吗？我很困惑，因为我认为那是 SecTrustSetAnchorCertificateOnly() 所做的。

Answer 1

这是添加到 NSURLConnectionDelegate 的 connection:didReceiveAuthenticationChallenge: 的代码。它以 DER 格式加载 CA，并根据该 CA 验证特定服务器。

if ([[[challenge protectionSpace] authenticationMethod] isEqualToString: NSURLAuthenticationMethodServerTrust])
{
    do
    {
        SecTrustRef serverTrust = [[challenge protectionSpace] serverTrust];
        if(nil == serverTrust)
            break; /* failed */

        NSData* caCert = [NSData dataWithContentsOfFile:@"ca-rsa-cert.der"];
        if(nil == caCert)
            break; /* failed */

        SecCertificateRef caRef = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)caCert);
        if(nil == caRef)
            break; /* failed */

        NSArray* caArray = [NSArray arrayWithObject:(__bridge id)(caRef)];
        if(nil == caArray)
            break; /* failed */

        OSStatus status = SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)caArray);
        if(!(errSecSuccess == status))
            break; /* failed */

        SecTrustResultType result = -1;
        status = SecTrustEvaluate(serverTrust, &result);
        if(!(errSecSuccess == status))
            break; /* failed */

        /* https://developer.apple.com/library/ios/technotes/tn2232/_index.html */
        /* https://developer.apple.com/library/mac/qa/qa1360/_index.html */
        /* kSecTrustResultUnspecified and kSecTrustResultProceed are success */
        if(result != kSecTrustResultUnspecified && result != kSecTrustResultProceed)
            break; /* failed */           

        // The only good exit point
        return [[challenge sender] useCredential: [NSURLCredential credentialForTrust: serverTrust]
                      forAuthenticationChallenge: challenge];

    } while(0);
}

// Bad dog
return [[challenge sender] cancelAuthenticationChallenge: challenge];

如果您在错误路径上调用 [connection cancel];，则 connection:didFailWithError: 将不会被调用。