我想在用户访问网站之前在钥匙串中安装/保存证书。 我有一个 HTTPS 服务器，我的应用在用户转到 https://mysite 之前对其进行身份验证。
有没有一种方法可以通过钥匙串中的 POST 请求安装/保存证书，或者我可以将该证书（文件）复制到资源包以将其标记为受信任？
【问题讨论】：
标签： ios ssl certificate installation keychain
获得 der 格式的服务器证书后，您可以尝试以下代码：
+ (void) addCertToKeychain:(NSData*)certInDer
{
OSStatus err = noErr;
SecCertificateRef cert;
cert = SecCertificateCreateWithData(NULL, (CFDataRef) certInDer);
assert(cert != NULL);
CFTypeRef result;
NSDictionary* dict = [NSDictionary dictionaryWithObjectsAndKeys:
(id)kSecClassCertificate, kSecClass,
cert, kSecValueRef,
nil];
err = SecItemAdd((CFDictionaryRef)dict, &result);
assert(err == noErr || err == errSecDuplicateItem);
CFRelease(cert);
}
它将证书添加到您的应用程序的钥匙串沙箱中，即没有其他应用程序会信任您的证书。
【讨论】：
您有两种选择：将服务器的证书添加到钥匙串或手动执行验证。无论您采用哪种方法，您都需要在您的应用程序中包含一个 DER 编码的 X.509 公共证书。在下面的示例中，它被命名为“ios-trusted-cert.der”）并使用它创建一个 SecCertificateRef。 （如果您的服务器证书是根证书颁发机构链的一部分，您应该安装根证书颁发机构而不是您服务器的证书。）
NSBundle *bundle = [NSBundle bundleForClass:[self class]];
NSData *iosTrustedCertDerData =
[NSData dataWithContentsOfFile:[bundle pathForResource:@"ios-trusted-cert"
ofType:@"der"]];
SecCertificateRef certificate =
SecCertificateCreateWithData(NULL,
(CFDataRef) iosTrustedCertDerData);
请记住，SecCertificateCreateWithData 遵循内存所有权的创建规则，所以当您不再需要它时必须 CFRelease 以避免内存泄漏。
接下来，您可以将证书添加到应用的钥匙串中。当您希望 iOS 为您创建的每个新套接字信任您的证书时，这是合适的。
- (void) useKeychain: (SecCertificateRef) certificate {
OSStatus err =
SecItemAdd((CFDictionaryRef) [NSDictionary dictionaryWithObjectsAndKeys:
(id) kSecClassCertificate, kSecClass,
certificate, kSecValueRef,
nil],
NULL);
if ((err == noErr) || // success!
(err == errSecDuplicateItem)) { // the cert was already added. Success!
// create your socket normally.
// This is oversimplified. Refer to the CFNetwork Guide for more details.
CFReadStreamRef readStream;
CFWriteStreamRef writeStream;
CFStreamCreatePairWithSocketToHost(NULL,
(CFStringRef)@"localhost",
8443,
&readStream,
&writeStream);
CFReadStreamSetProperty(readStream,
kCFStreamPropertySocketSecurityLevel,
kCFStreamSocketSecurityLevelTLSv1);
CFReadStreamOpen(readStream);
CFWriteStreamOpen(writeStream);
} else {
// handle the error. There is probably something wrong with your cert.
}
}
如果您只想验证您正在创建的套接字的证书而不验证应用程序中的其他套接字，您可以手动验证您对证书的信任。首先，创建一个套接字（假设您的服务器与您的客户端在同一台机器上侦听端口 8443）并在其 ssl 设置中禁用其证书链验证：
- (void) verifiesManually: (SecCertificateRef) certificate {
CFReadStreamRef readStream;
CFWriteStreamRef writeStream;
CFStreamCreatePairWithSocketToHost(NULL,
(CFStringRef)@"localhost",
8443,
&readStream,
&writeStream);
// Set this kCFStreamPropertySocketSecurityLevel before
// setting kCFStreamPropertySSLSettings.
// Setting kCFStreamPropertySocketSecurityLevel
// appears to override previous settings in kCFStreamPropertySSLSettings
CFReadStreamSetProperty(readStream,
kCFStreamPropertySocketSecurityLevel,
kCFStreamSocketSecurityLevelTLSv1);
// this disables certificate chain validation in ssl settings.
NSDictionary *sslSettings =
[NSDictionary dictionaryWithObjectsAndKeys:
(id)kCFBooleanFalse, (id)kCFStreamSSLValidatesCertificateChain,
nil];
CFReadStreamSetProperty(readStream,
kCFStreamPropertySSLSettings,
sslSettings);
NSInputStream *inputStream = (NSInputStream *)readStream;
NSOutputStream *outputStream = (NSOutputStream *)writeStream;
[inputStream setDelegate:self];
[outputStream setDelegate:self];
[inputStream scheduleInRunLoop:[NSRunLoop currentRunLoop]
forMode:NSDefaultRunLoopMode];
[outputStream scheduleInRunLoop:[NSRunLoop currentRunLoop]
forMode:NSDefaultRunLoopMode];
CFReadStreamOpen(readStream);
CFWriteStreamOpen(writeStream);
}
然后，当您收到您的套接字已准备好写入数据的回调时，您应该在向服务器写入任何数据或从服务器读取任何数据之前验证对您的服务器包含的证书的信任。首先 (1)，使用您连接的服务器的主机名创建客户端 SSL 策略。主机名包含在服务器的证书中，以验证 DNS 指向您的服务器是您信任的服务器。接下来 (2)，您从套接字中获取实际的服务器证书。如果服务器的证书是证书链的一部分，则可能有多个证书与服务器关联。当您拥有实际的服务器证书时，您可以 (3) 创建一个信任对象。信任对象代表信任评估的本地上下文。它隔离了个人信任评估，而钥匙串证书适用于所有受信任的套接字。拥有信任对象后，您可以 (4) 设置锚证书，即您信任的证书。最后（5），您可以评估信任对象并发现服务器是否可以信任。
#pragma mark -
#pragma mark NSStreamDelegate
- (void)stream:(NSStream *)aStream
handleEvent:(NSStreamEvent)eventCode {
switch (eventCode) {
case NSStreamEventNone:
break;
case NSStreamEventOpenCompleted:
break;
case NSStreamEventHasBytesAvailable:
break;
case NSStreamEventHasSpaceAvailable:
// #1
// NO for client, YES for server. In this example, we are a client
// replace "localhost" with the name of the server to which you are connecting
SecPolicyRef policy = SecPolicyCreateSSL(NO, CFSTR("localhost"));
SecTrustRef trust = NULL;
// #2
CFArrayRef streamCertificates =
[aStream propertyForKey:(NSString *) kCFStreamPropertySSLPeerCertificates];
// #3
SecTrustCreateWithCertificates(streamCertificates,
policy,
&trust);
// #4
SecTrustSetAnchorCertificates(trust,
(CFArrayRef) [NSArray arrayWithObject:(id) self.certificate]);
// #5
SecTrustResultType trustResultType = kSecTrustResultInvalid;
OSStatus status = SecTrustEvaluate(trust, &trustResultType);
if (status == errSecSuccess) {
// expect trustResultType == kSecTrustResultUnspecified
// until my cert exists in the keychain see technote for more detail.
if (trustResultType == kSecTrustResultUnspecified) {
NSLog(@"We can trust this certificate! TrustResultType: %d", trustResultType);
} else {
NSLog(@"Cannot trust certificate. TrustResultType: %d", trustResultType);
}
} else {
NSLog(@"Creating trust failed: %d", status);
[aStream close];
}
if (trust) {
CFRelease(trust);
}
if (policy) {
CFRelease(policy);
}
break;
case NSStreamEventErrorOccurred:
NSLog(@"unexpected NSStreamEventErrorOccurred: %@", [aStream streamError]);
break;
case NSStreamEventEndEncountered:
break;
default:
break;
}
}
【讨论】：