评估服务器证书
如何检测自签名证书和已撤销或过期的证书？
我正在使用 NSURLConnection 并实现 connection:didReceiveAuthenticationChallenge: on delegate:
- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge{
if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]){
NSURLProtectionSpace *tmpSpace=[challenge protectionSpace];
SecTrustRef currentServerTrust=[tmpSpace serverTrust];
SecTrustResultType trustResult;
OSStatus err = SecTrustEvaluate(currentServerTrust, &trustResult);
BOOL trusted = (err == noErr) && ((trustResult == kSecTrustResultProceed) || (trustResult == kSecTrustResultUnspecified));
if (trusted){
// Do something
}
}
}
目前“if (trusted){}”块仅适用于 iOS 信任的证书，我希望它也适用于其他人，但前提是证书不是“ t 被撤销或过期。
该文档使用 SecTrustSettingsSetTrustSettings 来更改设置并重新评估信任。但我找不到适用于 iOS 的此方法（或 SecTrustSetting），仅适用于 Mac。
谢谢
How can I detect a self signed certificate from a revoked or expired ones?
I'm using NSURLConnection and implementing connection:didReceiveAuthenticationChallenge: on delegate:
- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge{
if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]){
NSURLProtectionSpace *tmpSpace=[challenge protectionSpace];
SecTrustRef currentServerTrust=[tmpSpace serverTrust];
SecTrustResultType trustResult;
OSStatus err = SecTrustEvaluate(currentServerTrust, &trustResult);
BOOL trusted = (err == noErr) && ((trustResult == kSecTrustResultProceed) || (trustResult == kSecTrustResultUnspecified));
if (trusted){
// Do something
}
}
}
Currently the "if (trusted){}" block only work for certificates trusted by iOS, I want it to work for others as well, but only if the certificate isn't revoked or expired.
The documentation is using SecTrustSettingsSetTrustSettings for changing the settings and reevaluate the trust. but I couldn't find this method (or the SecTrustSetting) for iOS, only for Mac.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
为了成功进行信任评估，
无论哪种情况，您都需要有权访问锚点证书。
For the trust evaluation to succeed,
In either case, you need to have access to the anchor certificate.
请阅读我关于此问题的帖子：
有关 iOS 上 SSL/TLS 证书吊销机制的详细信息
iOS/Security.Framework 的 CRL 和 OCSP 行为？
基本上：
read my post here on this issue:
Details on SSL/TLS certificate revocation mechanisms on iOS
CRL and OCSP behavior of iOS / Security.Framework?
Basically: