如何在iOS中检索ssl服务器证书？
我希望能够获得 ssl 证书（如果可能的话+链），以便能够显示可分辨名称并确定它是否是 EV 证书。 （通过证书策略检测 EV 证书（wikipedia）
据我所知，您只能得到如果证书是自签名的，
是否可以使用 CFNetwork 等较低层来检索证书？
I'd like to be able to get the ssl certificate (+chain if possible) to be able to display the distinguished name and to determine if it is an EV certificate. (detecting EV certs via certificate policies (wikipedia)
From what I've seen you only get presented with some certificate details if the certificate is self-signed.
Is it possible using lower layers like CFNetwork to retrieve the certificate(s)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
通过 macnetworkprog.lists.apple.com 邮件列表
http://web.archiveorange.com/archive/v/x0fiWEI9emJFc36DY0UP 并提到了开发者论坛中的一些地方
为此，请执行以下操作：
实现
-connection:canAuthenticateAgainstProtectionSpace:委托回调。在您的实现中，如果
保护空间是
NSURLAuthenticationMethodServerTrust，你有两个选择：
2a。返回
NO，并让默认的 TLS 算法生效。2b。返回
YES，在这种情况下，您的-connection:didReceiveAuthenticationChallenge:委托回调将被调用。如果您想在制作之前查看证书
决定时，您可以在保护空间对象上调用
-serverTrust来获取信任对象，然后使用 SecTrust API 获取
证书链。
如果您采用路径 2b，您的
-connection:didReceiveAuthenticationChallenge:委托回调将被调用。您有两个选择：3a。通过对质询的发送者调用
-cancelAuthenticationChallenge:来禁止连接。3b。通过对质询的发送者调用
-useCredential:forAuthenticationChallenge:来允许连接。要获取凭据，请调用-[NSURLCredential initWithTrust:]。实际上，您在这里传递什么信任对象并不重要；保护空间中的即可。您不必同步执行此操作。你可以只锁住
挑战并从您的委托回调中返回，然后解决
在未来的某个时刻挑战。
via the macnetworkprog.lists.apple.com mailing list
http://web.archiveorange.com/archive/v/x0fiWEI9emJFc36DY0UP and mentioned a few places in the Developer Forums
To do this:
Implement the
-connection:canAuthenticateAgainstProtectionSpace:delegate callback.In your implementation, if the authentication method of the
protection space is
NSURLAuthenticationMethodServerTrust, you havetwo choices:
2a. Return
NO, and let the default TLS algorithm kick in.2b. Return
YES, in which case your-connection:didReceiveAuthenticationChallenge:delegate callback will be called.If you want to look at the certificates before you make that
decision, you can call
-serverTruston the protection space object toget a trust object, and then use the SecTrust API to get the
certificate chain.
If you take path 2b, your
-connection:didReceiveAuthenticationChallenge:delegate callback will be called. You have two choices:3a. Disallow the connection by calling
-cancelAuthenticationChallenge:on the challenge's sender.3b. Allow the connection by calling
-useCredential:forAuthenticationChallenge:on the challenge's sender. To get a credential, call-[NSURLCredential initWithTrust:]. It doesn't actually matter what trust object you pass in here; the one from the protection space will do.You don't have to do this synchronously. You can just latch the
challenge and return from your delegate callback and then resolve the
challenge at some point in the future.