我正在使用 AFNetworking 3.0。我的网络服务器带有由 Global Sign 签名的 https 证书。我想将证书固定添加到我的 iOS 应用程序。我的代码如下:
- (AFSecurityPolicy*)customSecurityPolicy{
AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeNone];
NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"server" ofType:@"cer"];
NSData *certData = [NSData dataWithContentsOfFile:cerPath];
[securityPolicy setAllowInvalidCertificates:NO];
[securityPolicy setValidatesDomainName:YES];
//securityPolicy.validatesCertificateChain = NO;
[securityPolicy setPinnedCertificates:[NSKeyedUnarchiver unarchiveObjectWithData:certData]];
return securityPolicy;
}
我的客户端代码:
NSString *url = SERVER_URL;
AFHTTPSessionManager *manager = [AFHTTPSessionManager manager];
manager.responseSerializer.acceptableContentTypes = [NSSet setWithObject:@"application/json"];
manager.securityPolicy = [utils customSecurityPolicy];
[manager GET:url parameters:nil progress:nil success:^(NSURLSessionTask *task, id responseObject) {
NSLog(@"JSON: %@", responseObject);
} failure:^(NSURLSessionTask *operation, NSError *error) {
NSLog(@"Error: %@", error);
}];
我们使用 burp 套件作为中间人代理，我们能够中断请求并监控请求的内容。
那么，我该如何正确实现证书固定呢？
最佳答案
这是一个位于 AFNetworking 之外的有效问题，您唯一发现的是您使用的库实现 curl --cacert 操作的方式。
在AFNetworking 的具体情况下，我有这种情况:
let sessionManager = AFHTTPSessionManager()
sessionManager.responseSerializer = AFJSONResponseSerializer()
sessionManager.requestSerializer = AFJSONRequestSerializer()
let configuration = ServiceConfiguration.sharedInstance.configuration
if let policy = configuration?.getSecurityPolicy()?.policy() as? AFSecurityPolicy {
sessionManager.securityPolicy = policy
}
方法 getSecurityPolicy 返回一个可选的 RequestSecurityPolicy 对象(这是一个协议(protocol))。
要制作一个 AFSecurityPolicy，我有:
import AFNetworking
class SSLPinningPolicy: NSObject, RequestSecurityPolicy {
// MARK: - Private properties -
private var certificatesDictionary: [String: Data] = [:]
// MARK: - Initilizers -
init(certicatePaths: [String]) {
super.init()
for path in certicatePaths {
if let certPath = Bundle.main.path(forResource: path, ofType: "der") {
let url = URL(fileURLWithPath: certPath)
do {
let data = try Data(contentsOf: url)
self.certificatesDictionary[path] = data
} catch {
}
}
}
}
// MARK: - RequestSecurityPolicy delegates -
func policy() -> AnyObject {
let policy = AFSecurityPolicy(pinningMode: .certificate)
policy.allowInvalidCertificates = true
policy.pinnedCertificates = self.certificates()
return policy
}
func certificates() -> Set<Data> {
return Set(self.certificatesDictionary.map { $0.value })
}
}
加上
为了将我的证书从 .pem 转换为 .der，您只需在您的 shell 中使用 openssl:
openssl x509 -outform der -in MyCertificate.pem -out MyCertificate.der
关于ios - AFNetworking 3.0 的 SSL 固定，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/37399055/