amazon-s3 - 从Amazon S3(HTTPS)加载图像时在iPad上获取 “The certificate for this server is invalid.”，但在模拟器上没有错误

Question

我正在尝试显示存储在Amazon S3存储桶上的图像。该URL类似于https://s3.amazon.com/..../test.jpg。每当我在iPhone模拟器上执行此操作时，图像都会正确显示。但是，如果我在实际设备上对其进行测试，则会不断得到:

Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “s3.amazonaws.com” which could put your confidential information at risk." UserInfo=0x20007030 {NSErrorFailingURLStringKey=https://s3.amazonaws.com/.../test.jpeg, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, NSErrorFailingURLKey=https://s3.amazonaws.com/.../test.jpeg, NSLocalizedDescription=The certificate for this server is invalid. You might be connecting to a server that is pretending to be “s3.amazonaws.com” which could put your confidential information at risk., NSUnderlyingError=0x20014d40 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “s3.amazonaws.com” which could put your confidential information at risk.", NSURLErrorFailingURLPeerTrustErrorKey=}

有任何想法吗？!

谢谢!

Answer 1

我从S3收到了相同的证书错误，发现将其添加到NSURLConnectionDelegate可以解决此问题:

-(void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
{
   if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust] &&
       [challenge.protectionSpace.host hasSuffix:@"example.com"])
   {
       // accept the certificate anyway
       [challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
   }
   else
   {
       [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
   }
}

注意:您需要将“example.com”更改为您信任的域，或者使用比“hasSuffix”更复杂的机制。

仅供引用，Apple Technote TN2232“HTTPS服务器信任评估”详细介绍了为何拒绝证书以及如何处理证书:
https://developer.apple.com/library/ios/technotes/tn2232/_index.html

感谢Gordon Henriksen在 https://stackoverflow.com/a/2033823/235229上回答了这个问题，但是使用了较旧的api。