将证书链存储在应用程序钥匙串中
在 iOS 上，我知道我们可以使用 SecTrustEvaluate() 评估信任。要创建信任，我们可以从 *.p12 文件导入它，也可以使用一组证书和一组策略来创建它。
我还知道，为了确保默认情况下不可信的服务器是可信的，我们可以使用 SecTrustSetAnchorCertificates() 来扩充 SecTrustEvaluate() 用于验证服务器证书的根 CA 列表。
现在，我如何确保这些锚定证书在后续启动时可用？我可以在应用程序钥匙串中存储证书、密钥和身份，但不能存储证书链。即使我将所有证书都存储在链中，我如何知道哪些证书将用作锚定证书？
我想到的一种解决方案是从钥匙串中获取所有证书并将它们设置为锚证书。另一种方法可能是将磁盘上的所有证书链作为 *.p12 文件，并在每次应用程序运行时加载它们一次。
On iOS, I know that we can evaluate a trust with SecTrustEvaluate(). To create a trust, we either import it from a *.p12 file or create it using an array of certificates and a set of policies.
I also know that in order to ensure that a server, that is not trusted by default, is trusted, we can use SecTrustSetAnchorCertificates() to augment the list of root CAs SecTrustEvaluate() uses to verify the server's certificate.
Now, how can I ensure that these anchor certificates are available on a subsequent launch? I can store certificates, keys and identities in the application keychain, but not a certificate chain. Even if I store all the certificates in the chain, how will I know what certificates are to be used as anchor certificates?
One solution that comes to mind is to just get all the certificates from the keychain and set them as anchor certificates. Another method could be to all the certificate chains on the disk as *.p12 files and load them once on every application run.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
Apple Devforums 的 eskimo1 如此回答：
首先，您不需要将证书存储在钥匙串中。如果您愿意，可以将它们存储在其他地方（并使用 SecCertificateCreateWithData 创建 SecCertificateRef）。
其次，您的问题涉及 .p12 文件，但我不确定这与事情有什么关系。通常，您仅使用 .p12 文件来分发机密信息，并且证书不是机密的。
最后，您可以通过仅存储对该链中每个证书的持久引用（或通过存储每个证书的实际数据）来存储证书链。
eskimo1 from Apple Devforums answered this so:
First up, you don't need to store the certificates in the keychain. You can store them elsewhere if you like (and create the SecCertificateRef using SecCertificateCreateWithData).
Secondly, your question talks about .p12 files, but I'm not sure what this has to do with things. In general you only use a .p12 file to distribute confidential information, and certificates are not confidential.
Finally, you can store a certificate chain by just storing the persistent reference to each certificate in that chain (or by storing the actual data of each certificate).