将内部 CA 根证书添加到 iPhone iOS 配置文件
我的 iOS 应用程序目前正在开发中，我们连接的服务正在使用由我们内部（公司）CA 签名的证书。我的应用程序在很多地方都使用同步请求调用安全的 Web 服务。切换到异步并处理证书挑战以手动接受来自我们域的证书将需要付出巨大的努力。
我想做的是将我们的 CA 根证书添加到我们团队的配置文件中，以便在开发过程中将其识别为受信任的 CA。有人可以帮我做这个吗？
如果这不可能，有人有什么建议吗？以下是我看到的从最好到最差的选项。
- 将内部 CA 根证书添加到开发配置文件中的受信任 CA
- 购买证书（不想这样做，因为我们的部署服务器已经拥有有效的证书，并且我不想在我们的开发中只需要的证书上浪费金钱） /测试环境）。
- 切换到 ASI 框架以绕过挑战（不想这样做，因为它使我的应用程序不太安全。我的代码是正确且安全的，但我无法在开发/测试中进行测试。我不想让我的应用程序更糟糕的是，我可以在我的开发环境中进行测试。）
- 切换到异步请求并通过接受来自我的域的所有证书来处理挑战（也不想对工作代码进行代码更改。此外，我们还需要付出巨大的努力切换到异步，我们没有时间）。
感谢所有帮助！谢谢。
My iOS app is in development right now and the services we connect to are using a cert that is signed by our internal (company) CA. My app in many places calls secure web services using synchronous requests. It would be a large effort to switch to async and handle the cert challenge to manually accept certs from our domain.
What I would like to do is to add our CA root cert to our team's provisioning profile so that it is recognized, just in development, as a trusted CA. Can someone help me do this please?
If this is not possible, does anyone have any suggestions? Here are the options I see from best to worst.
- Add internal CA root cert to trusted CAs in dev provisioning profile
- Buy a cert (don't want to do this because our deployment server already has a valid cert, and i wont want to waste money on a cert that I just need in our dev/test environments).
- Switch to ASI framework to bypass challenges (don't want to do this because it makes my app less secure. My code is correct and secure as is, but I cannot test in dev/test. I don't want to make my app worse just so that I can test in my dev env.)
- Switch to async requests and handle challenges by accepting all certs from my domain (also don't want to make code changes for working code. Also it is a huge effort for us to switch to async, and we don't have the time).
All help is appreciated! Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
好吧，我决定选择 2，并为我们的内部机器关闭 SSL。这不是理想的解决方案，但我找不到更好的解决方案。
Well I decided to go with 2 and just turn SSL off for our internal machines. Not the ideal solution, but I couldn't find a better one.