在 iOS 上使用 CFSockets 时如何手动验证 TLS 证书？

Question

我正在使用CFStreamCreatePairWithSocketToHost 创建与服务器的连接。该服务器正在使用自签名证书，我必须对其进行验证。 我一直在尝试寻找任何方法来检索服务器证书，但我迷路了，找不到任何可以让我检索它的方法/类。

我将不胜感激指出如何在这样的代码中获得它：

CFReadStreamRef readStream;
CFWriteStreamRef writeStream;
CFStreamCreatePairWithSocketToHost(kCFAllocatorDefault, (__bridge CFStringRef) address, (UInt32) port, &readStream, &writeStream);

NSInputStream *inputStream = (__bridge_transfer NSInputStream *) readStream;
NSOutputStream *outputStream = (__bridge_transfer NSOutputStream *) writeStream;
[inputStream setDelegate:self];
[outputStream setDelegate:self];
[inputStream scheduleInRunLoop:[NSRunLoop currentRunLoop] forMode:NSDefaultRunLoopMode];
[outputStream scheduleInRunLoop:[NSRunLoop currentRunLoop] forMode:NSDefaultRunLoopMode];

NSDictionary *settings = @{(NSString *) kCFStreamSSLValidatesCertificateChain: @NO};

CFReadStreamSetProperty((__bridge CFReadStreamRef) inputStream, kCFStreamPropertySSLSettings, (__bridge CFTypeRef) settings);

[inputStream open];
[outputStream open];

Answer 1

在又一次谷歌搜索中，我终于偶然发现了为数不多的清楚描述流程的 Apple Docs 之一： https://developer.apple.com/library/content/technotes/tn2232/_index.html#//apple_ref/doc/uid/DTS40012884-CH1-SECCFSOCKETSTREAM

这是 Apple 提供的示例代码： https://developer.apple.com/library/content/documentation/NetworkingInternet/Conceptual/NetworkingTopics/Articles/OverridingSSLChainValidationCorrectly.html