ios - 在iOS上验证分离的PKCS7签名:验证错误:证书目的不受支持

Question

我试图使用下面的代码验证PKCS7签名来自API端点here

    NSURL *appleRootURL = [[NSBundle mainBundle] URLForResource:@"AppleIncRootCertificate" withExtension:@"cer"];

    NSData *appleRootData = [NSData dataWithContentsOfURL:appleRootURL];


    // Create a memory buffer to extract the PKCS #7 container

    BIO *receiptBIO ;
    receiptBIO = BIO_new_mem_buf((void *)[receiptData bytes], (int)[receiptData length]);

    BIO *dataBIO;
    dataBIO = BIO_new_mem_buf((__bridge void *)base64Encoded, (int)[base64Encoded length]);

    BIO *b_out;

    BIO *appleRootBIO;
    appleRootBIO = BIO_new_mem_buf((void *)[appleRootData bytes], (int)[appleRootData length]);


    PKCS7 *receiptPKCS7 = d2i_PKCS7_bio(receiptBIO, NULL);

    X509 *appleRootX509 = d2i_X509_bio(appleRootBIO, NULL);
    X509_STORE *store = X509_STORE_new();
    X509_STORE_add_cert(store, appleRootX509);

    OpenSSL_add_all_digests();
    OpenSSL_add_all_algorithms();

    int result = PKCS7_verify(receiptPKCS7, NULL, store, receiptBIO, b_out, 0);

    if (result != 1) {
        // Validation fails
        NSLog(@"result is %d", result);
    }

但是，将其运行到设备后，出现OPENSSL错误:

1010506260:错误:21075075:PKCS7例程:PKCS7_verify:证书验证错误:pk7_smime.c:342:验证错误:证书不受支持

我哪里做错了？ :-(

Answer 1

我知道这个问题太老了，但是我们最近经历并解决了完全相同的问题。

尝试将PKCS7_NOVERIFY作为最后一个参数传递给PKCS7_verify()，以跳过签署者证书上的链验证。您(像我们一样，进行自定义的分离签名伪造)可能具有签名者证书，该证书在此特定设置中未通过链验证。