从证书中获取公钥/私钥答案

【问题标题】：Get public/private key from certificate从证书中获取公钥/私钥
【发布时间】：2016-10-21 11:25:43
【问题描述】：

我尝试从设备上保存的证书中获取公钥或私钥。我正在使用这种方法：

    - (SecKeyRef)publicKeyFromFile:(NSString *)path
{
    NSData * certificateData = [[NSData alloc] initWithData:[[NSFileManager defaultManager] contentsAtPath:path]];

    if (certificateData != nil && certificateData.bytes != 0) {

        CFDataRef cfDataPath = CFDataCreate(NULL, [certificateData bytes], [certificateData length]);
        SecCertificateRef certificateFromFile = SecCertificateCreateWithData(NULL, cfDataPath);

        if (certificateFromFile) {
            SecPolicyRef secPolicy = SecPolicyCreateBasicX509();
            SecTrustRef trust;
            SecTrustCreateWithCertificates( certificateFromFile, secPolicy, &trust);
            SecTrustResultType resultType;
            SecTrustEvaluate(trust, &resultType);
            SecKeyRef publicKeyObj = SecTrustCopyPublicKey(trust);

            return publicKeyObj;
        }
    }

    return nil;
}

cfDataPath中有数据，但是certificateFromFile总是nil...

有谁知道问题出在哪里？

【问题讨论】：

您的标签已经表明这个问题是关于 iOS 的。无需将其添加到问题标题中。

标签： ios objective-c ssl-certificate x509certificate public-key-encryption

【解决方案1】：

苹果文档参考：

获取用于公钥加密的 SecKeyRef 对象从钥匙串中提取密钥如果您使用钥匙串中的现有公钥和私钥，请阅读证书、密钥和信任服务编程指南以了解如何检索该密钥的 SecKeychainItemRef 对象。获得 SecKeychainItemRef 后，您可以将其转换为 SecKeyRef 以与此 API 一起使用。导入现有的公钥和私钥导入和导出公钥和私钥对比生成新密钥要复杂一些，因为常用的不同密钥格式有很多。本示例介绍如何导入和导出 PEM（隐私增强邮件）格式的密钥对。

试试这个：

  -(BOOL)trustCertFromChallenge:(NSURLAuthenticationChallenge *)challenge
 {
SecTrustResultType trustResult;
SecTrustRef trust = challenge.protectionSpace.serverTrust;
OSStatus status = SecTrustEvaluate(trust, &trustResult);

//DLog(@"Failed: %@",error.localizedDescription);
//DLog(@"Status: %li | Trust: %@ - %li",(long)status,trust,(long)trustResult);

if (status == 0 && (trustResult == kSecTrustResultUnspecified || trustResult == kSecTrustResultProceed)) {

    SecKeyRef serverKey = SecTrustCopyPublicKey(trust);

    NSString *certPath = [[NSBundle mainBundle] pathForResource:@"MYCert" ofType:@"der"];
    NSData *certData = [NSData dataWithContentsOfFile:certPath];
    SecCertificateRef localCertificate = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certData);

    SecKeyRef localKey = NULL;
    SecTrustRef localTrust = NULL;
    SecCertificateRef certRefs[1] = {localCertificate};
    CFArrayRef certArray = CFArrayCreate(kCFAllocatorDefault, (void *)certRefs, 1, NULL);
    SecPolicyRef policy = SecPolicyCreateBasicX509();
    OSStatus status = SecTrustCreateWithCertificates(certArray, policy, &localTrust);

    if (status == errSecSuccess)
        localKey = SecTrustCopyPublicKey(localTrust);

    CFRelease(localTrust);
    CFRelease(policy);
    CFRelease(certArray);

     if (serverKey != NULL && localKey != NULL && [(__bridge id)serverKey isEqual:(__bridge id)localKey])
        return YES;
    else
        return NO;
}

//DLog(@"Failed: %@",error.localizedDescription);

return NO;
  }

请关注接受的答案以获取更多详细信息：Objective-C / C pulling private key (modulus) from SecKeyRef

【讨论】：