swift https证书单向验证

class Manager: NSObject {

func setAlamofireHttps() {

SessionManager.default.delegate.sessionDidReceiveChallenge = { (session: URLSession, challenge: URLAuthenticationChallenge) in

let method = challenge.protectionSpace.authenticationMethod

if method == NSURLAuthenticationMethodServerTrust {

//验证服务器，直接信任或者验证证书二选一，推荐验证证书，更安全

return HTTPSManager.trustServerWithCer(challenge: challenge)

// return HTTPSManager.trustServer(challenge: challenge)

}else if method == NSURLAuthenticationMethodClientCertificate {

//认证客户端证书

return HTTPSManager.sendClientCer()

}else{

//其他情况，不通过验证

return (.cancelAuthenticationChallenge, nil)

}

}

}

//不做任何验证，直接信任服务器

static private func trustServer(challenge: URLAuthenticationChallenge) -> (URLSession.AuthChallengeDisposition, URLCredential?) {

let disposition = URLSession.AuthChallengeDisposition.useCredential

letcredential =URLCredential.init(trust: challenge.protectionSpace.serverTrust!)

return(disposition, credential)

}

//验证服务器证书

static private func trustServerWithCer(challenge: URLAuthenticationChallenge) -> (URLSession.AuthChallengeDisposition, URLCredential?) {

var disposition: URLSession.AuthChallengeDisposition = .performDefaultHandling

varcredential:URLCredential?

//获取服务器发送过来的证书

letserverTrust:SecTrust= challenge.protectionSpace.serverTrust!

letcertificate =SecTrustGetCertificateAtIndex(serverTrust,0)!

letremoteCertificateData =CFBridgingRetain(SecCertificateCopyData(certificate))!

//加载本地CA证书

varcerPath =""

cerPath =Bundle.main.path(forResource:"本地证书名", ofType:"der")!

letcerUrl =URL(fileURLWithPath:cerPath)

letlocalCertificateData =try!Data(contentsOf: cerUrl)

print(remoteCertificateData)

print(localCertificateData)

if(remoteCertificateData.isEqual(localCertificateData)==true) {

//服务器证书验证通过

disposition =URLSession.AuthChallengeDisposition.useCredential

credential =URLCredential(trust: serverTrust)

}else{

//服务器证书验证失败

disposition =URLSession.AuthChallengeDisposition.cancelAuthenticationChallenge

}

return(disposition, credential)

}

//发送客户端证书交由服务器验证

static private func sendClientCer() -> (URLSession.AuthChallengeDisposition, URLCredential?) {

let disposition = URLSession.AuthChallengeDisposition.useCredential

varcredential:URLCredential?

//获取项目中P12证书文件的路径

letpath:String=Bundle.main.path(forResource:"你本地的p12证书文件名", ofType:"p12")!

letPKCS12Data =NSData(contentsOfFile:path)!

let key : NSString = kSecImportExportPassphrase as NSString

letoptions :NSDictionary= [key :"p12证书的密码"]//客户端证书密码

varitems:CFArray?

leterror =SecPKCS12Import(PKCS12Data, options, &items)

iferror==errSecSuccess{

letitemArr = items!asArray

letitem = itemArr.first!

letidentityPointer = item["identity"];

letsecIdentityRef = identityPointeras!SecIdentity

letchainPointer = item["chain"]

letchainRef = chainPointeras? [Any]

credential =URLCredential.init(identity: secIdentityRef, certificates: chainRef, persistence:URLCredential.Persistence.forSession)

}

return(disposition, credential)

}

}

上面是最终的代码跟网上的都差不多没什么好说的

但是问题是

读服务端给的cer证书的时候，

SecCertificateCreateWithData

总是返回为nil，

ServerTrustPolicy.certificates()

这个alamofire自带的识别本地证书的方法都没识别出证书的内容

public static funccertificates(in bundle:Bundle=Bundle.main) -> [SecCertificate] {

var certificates: [SecCertificate] = []

let paths =Set([".cer",".CER",".crt",".CRT",".der",".DER"].map{ fileExtensionin

bundle.paths(forResourcesOfType: fileExtension, inDirectory:nil)

}.joined())

for path in paths {

if

let certificateData = try?Data(contentsOf:URL(fileURLWithPath: path)) as CFData,

let certificate =SecCertificateCreateWithData(nil, certificateData)

{

certificates.append(certificate)

}

}

return certificates

}

path里是能识别出来的但是到证书那就没了这就很诡异了

查了半天原因是因为这个证书是服务器自己生成的，不是正规的CA机构颁发的，（虽然服务端的小伙伴一直说是正规机构发的）但是苹果安全性要求是很高的，只认正规机构颁发的cer 自己服务器生成的得是der cer这个怎么弄都读不出来，

最后跟服务端的小伙伴沟通无效自己把证书从cer转换了证书变成der的就没事了。。。

所以正规不正规的你懂得

原因是：The newly created certificate object. Call the CFRelease function to release this object when you are finished with it. Returns NULL if the data passed in the data parameter is not a valid DER-encoded X.509 certificate.

据说可以使用：

openssl x509 -in xxx.cer -outform der -out xxx.der来转

我用的是：

cer 转换der的网址

https://www.ssldun.com/tools/ssl-converter.php

所以不要盲目的不能偏听偏信解决问题还得靠自己