无法信任 iPhone 上的自签名证书
我目前正在尝试使用自签名证书连接到服务器。我正在使用 NSURLConnection 连接到服务器。如何确保我只信任正确的服务器并取消所有其他连接？我正在使用以下代码
- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
SecTrustResultType results;
SecTrustRef trust = [[challenge protectionSpace] serverTrust];
SecTrustEvaluate(trust, &results);
if (results == kSecTrustResultProceed || results == kSecTrustResultConfirm) {
[challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
} else {
[challenge.sender cancelAuthenticationChallenge:challenge];
}
}
目前 SecTrustEvaluate 始终返回等于 kSecTrustResultRecoverableTrustFailure 的结果。我已经使用 iPhone 配置实用程序在手机上安装了带有证书的配置文件，它被标记为已验证，但它没有改变结果。
任何人都可以帮助我获得自签名证书的 kSecTrustResultProceed 或 kSecTrustResultConfirm 信任结果吗？
I am currently trying to connect to a server with a self signed certificate. I am using NSURLConnection to connect to the server. How can I make sure that I only trust the right server and cancel all other connections? I am using the following code
- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
SecTrustResultType results;
SecTrustRef trust = [[challenge protectionSpace] serverTrust];
SecTrustEvaluate(trust, &results);
if (results == kSecTrustResultProceed || results == kSecTrustResultConfirm) {
[challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
} else {
[challenge.sender cancelAuthenticationChallenge:challenge];
}
}
Currently SecTrustEvaluate always returns with results equal to kSecTrustResultRecoverableTrustFailure. I have installed a configuration profile with the certificate on the phone using the iphone configuration utility and it is marked as verified but it did not change the results.
Can anyone help me get a trust result of either kSecTrustResultProceed or kSecTrustResultConfirm for a self signed certificate?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您需要确保您的证书具有某些扩展名。我配置了具有以下扩展名的证书，它对我有用（OpenSSL 格式）：
You'll need to make sure that your certificate has certain extensions. I configured a certificate with the following extensions, and it worked for me (OpenSSL format):