Swift 3如何使用SSL Pinning和AlamoFire验证服务器证书？

问题描述

我正在swift 3中编写一个需要与我的服务器通信的应用程序。我有der和crt格式的完整证书链，我是CA的（不要与自签名混淆）。如何在我的应用程序中使用它来验证我的服务器？以下是我的休息电话和回复

I'm writing an app in swift 3 that needs to talk to my server. I have the full certificate chain in der and crt format which I am the CA for(Not to be confused with self signed). How do I use this in my app to validate my server? Below is my rest call and response

休息电话：

var request = URLRequest(url: URL(string: "https://myserver/login")!)
    request.addValue("Content-Type", forHTTPHeaderField: "application/json")
    request.httpMethod = "GET"
    let session = URLSession.shared

    session.dataTask(with: request) {data, response, err in
        print("=========================DATA===============================")
        if data != nil {
            print(data!)
        }
        print("=========================RESPONSE===============================")
        if response != nil {
            print(response!)
        }
        print("=========================ERR===============================")
        if err != nil {
            print(err!)
        }
        }.resume()

输出：

=========================DATA===============================
=========================RESPONSE===============================
=========================ERR===============================
Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSURLErrorFailingURLPeerTrustErrorKey=<SecTrustRef: 0x60800011f020>, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9802, NSErrorPeerCertificateChainKey=(
"<cert(0x7fae4803d200) s: myserver i: MySubCA>",
"<cert(0x7fae48047000) s: MySubCA i: MyRootCA>",
"<cert(0x7fae48044600) s: MyRootCA i: MyRootCA>"
), NSUnderlyingError=0x60800005a040 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x60800011f020>, _kCFNetworkCFStreamSSLErrorOriginalValue=-9802, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9802, kCFStreamPropertySSLPeerCertificates=(
"<cert(0x7fae4803d200) s: myserver i: MySubCA>",
"<cert(0x7fae48047000) s: MySubCA i: MyRootCA>",
"<cert(0x7fae48044600) s: MyRootCA i: MyRootCA>"
)}}, NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., NSErrorFailingURLKey=https://myserver/login, NSErrorFailingURLStringKey=https://myserver/login, NSErrorClientCertificateStateKey=0}

推荐答案

我只是利用在线博客AlamoFire和openssl

I solved it pretty simply leveraging an online blog, AlamoFire and openssl

我使用AlamoFire进行iOS网络连接

I used AlamoFire for the networking in iOS

https://github.com/Alamofire/Alamofire

我在iOS中使用了一篇关于SSL固定的文章来找到正确的方向

I used an article about SSL pinning in iOS to get on the right direction

https://infinum.co/the-capsized-eight/articles/how-to-make-your-ios-apps-more-secure-with-ssl-pinning

我使用openssl将我的证书转换为der格式

I used openssl to convert my cert to der format

https://help.netmail.com/display/KB/Converting+SSL+Certificate+File+from+CRT+TO+DER+TO+PEM

Der conversion

Der conversion

openssl x509 -in cert.crt -out cert.der -outform DER

您需要将der格式的证书添加到您的应用包中。

You will need to add the der formatted cert to your app bundle.

Swift 3实现

// Your hostname and endpoint
let hostname = "YOUR_HOST_NAME"
let endpoint = "YOUR_ENDPOINT"
let cert = "YOUR_CERT" // e.g. for cert.der, this should just be "cert"

// Set up certificates
let pathToCert = Bundle.main.path(forResource: cert, ofType: "der")
let localCertificate = NSData(contentsOfFile: pathToCert!)
let certificates = [SecCertificateCreateWithData(nil, localCertificate!)!]

// Configure the trust policy manager
let serverTrustPolicy = ServerTrustPolicy.pinCertificates(
    certificates: certificates,
    validateCertificateChain: true,
    validateHost: true
)
let serverTrustPolicies = [hostname: serverTrustPolicy]
let serverTrustPolicyManager = ServerTrustPolicyManager(policies: serverTrustPolicies)

// Configure session manager with trust policy
afManager = SessionManager(
    configuration: URLSessionConfiguration.default,
    serverTrustPolicyManager: serverTrustPolicyManager
)


afManager.request(endpoint, method: .get).responseJSON { response in
    debugPrint("All Response Info: \(response)")
}

这篇关于Swift 3如何使用SSL Pinning和AlamoFire验证服务器证书？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！