參考文章：
http://www.ruanyifeng.com/blog/2014/02/ssl_tls.html
http://www.ruanyifeng.com/blog/2014/09/illustration-ssl.html
http://www.itdecent.cn/p/20d5fb4cd76d
雙向驗證：
http://blog.csdn.net/codingfire/article/details/53419521
http://m.ithao123.cn/content-10472230.html
OpenSSL:
https://www.openssl.org/docs/man1.0.2/
http://shjia.blog.51cto.com/2476475/1427138
通篇看完覺得一張圖解釋Https很??。
注意：
- 證書和服務器需要滿足Requirements for Connecting Using ATS的條件。
- 保證1滿足。
NSURLConnection-兩種方式實現(xiàn) - 客戶端驗證服務器
其他的如NSURLSession 調(diào)用方式和位置不同，原理一樣
- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
NSLog(@"authenticatemethod:%@",challenge.protectionSpace.authenticationMethod);
BOOL userJustCheckCertificateSame = NO;
{
if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
NSMutableArray *certificates = [NSMutableArray array];
NSData*caCert =[NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"new_cacert" ofType:@"cer"]];
NSData*serverCert =[NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"new_server" ofType:@"cer"]];
if (userJustCheckCertificateSame) {
[certificates addObject:caCert];
[certificates addObject:serverCert];
[self serverTrustjustCheckCertificateSame:challenge pinCertificates:certificates];
}else{
SecCertificateRef caCertRef = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)caCert);
SecCertificateRef serverCertRef = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)serverCert);
[certificates addObject:(__bridge_transfer id)caCertRef];
[certificates addObject:(__bridge_transfer id)serverCertRef];
[self serverTrustSystemMethod:challenge pinCertificates:certificates];
}
}else if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) {
//暫時不做client 驗證
[challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
// NSData*certData =[NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"old_client" ofType:@"cer"]];
// [self addCertToKeychain:certData];
// NSURLCredential *credential = [self getClientCertFromKeychain];
// [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
}else{
[challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
}
}
}
// 如果server 返回的證書鏈 里面有一個在local 證書集合里面，即可認為合法
- (void)serverTrustjustCheckCertificateSame:(NSURLAuthenticationChallenge *)challenge pinCertificates:(NSMutableArray *)pinCertificates{
SecTrustRef serverTrust = challenge.protectionSpace.serverTrust;
if ([self localCaInServerChainList:serverTrust pinCertificates:pinCertificates]) {
NSURLCredential *cred = [NSURLCredential credentialForTrust:serverTrust];
[challenge.sender useCredential:cred forAuthenticationChallenge:challenge];
}else{
[challenge.sender cancelAuthenticationChallenge:challenge];
}
}
- (BOOL)localCaInServerChainList:(SecTrustRef)serverTrust pinCertificates:(NSMutableArray *)pinCertificates{
CFIndex certificateCount = SecTrustGetCertificateCount(serverTrust);
for (CFIndex i = 0; i < certificateCount; i++) {
SecCertificateRef certificate = SecTrustGetCertificateAtIndex(serverTrust, i);
NSData *trustChainCertificate = (__bridge_transfer NSData *)SecCertificateCopyData(certificate);
if ([pinCertificates containsObject:trustChainCertificate]) {
return YES;
}
}
return NO;
}
// 調(diào)用系統(tǒng)方法
- (void)serverTrustSystemMethod:(NSURLAuthenticationChallenge *)challenge pinCertificates:(NSMutableArray *)pinCertificates{
//1)獲取trust object
SecTrustRef trust = challenge.protectionSpace.serverTrust;
SecTrustResultType result;
NSMutableArray *policies = [NSMutableArray array];
// BasicX509 不驗證域名是否相同（我們用的IP）
SecPolicyRef policy = SecPolicyCreateBasicX509();
[policies addObject:(__bridge_transfer id)policy];
SecTrustSetPolicies(trust, (__bridge CFArrayRef)policies);
//注意：添加自己的證書作為可信列表
SecTrustSetAnchorCertificates(trust, (__bridge CFArrayRef)pinCertificates);
//禁用系統(tǒng)可信列表
//SecTrustSetAnchorCertificatesOnly(trust, false);
//2)SecTrustEvaluate會查找前面SecTrustSetAnchorCertificates設置的證書或者系統(tǒng)默認提供的證書，對trust進行驗證
OSStatus status = SecTrustEvaluate(trust, &result);
if (status == errSecSuccess &&
(result == kSecTrustResultProceed ||
result == kSecTrustResultUnspecified))
{
//3)驗證成功，生成NSURLCredential憑證cred，告知challenge的sender使用這個憑證來繼續(xù)連接
NSURLCredential *cred = [NSURLCredential credentialForTrust:trust];
[challenge.sender useCredential:cred forAuthenticationChallenge:challenge];
} else {
//5)驗證失敗，取消這次驗證流程
[challenge.sender cancelAuthenticationChallenge:challenge];
}
}
NSURLConnection -服務器驗證客戶端
所有參考鏈接：
http://www.cnblogs.com/qiyer/p/4871421.html
http://m.ithao123.cn/content-10472230.html
http://oncenote.com/2014/10/21/Security-1-HTTPS/
http://oncenote.com/2015/09/16/Security-2-HTTPS2/#verify_safely
http://www.cnblogs.com/interdrp/p/4881116.html
http://www.cnblogs.com/pixy/p/4722381.html
http://www.cnblogs.com/JeffreySun/archive/2010/06/24/1627247.html
http://www.itdecent.cn/p/2927ca2b3719
http://www.ruanyifeng.com/blog/2014/09/illustration-ssl.html
http://www.ruanyifeng.com/blog/2014/02/ssl_tls.html
https://zh.wikipedia.org/wiki/%E8%BF%AA%E8%8F%B2-%E8%B5%AB%E7%88%BE%E6%9B%BC%E5%AF%86%E9%91%B0%E4%BA%A4%E6%8F%9B
http://www.cnblogs.com/oc-bowen/p/5896041.html
http://www.cnblogs.com/jukan/p/5527922.html
http://www.cnblogs.com/guogangj/p/4118605.html
http://blog.csdn.net/linda1000/article/details/8676330
http://blog.sina.com.cn/s/blog_a9303fd90101jmtx.html
https://tools.ietf.org/html/rfc5246#section-7.3
https://developer.apple.com/library/prerelease/content/documentation/Security/Conceptual/CertKeyTrustProgGuide/revisionHistory.html#//apple_ref/doc/uid/TP40001358-CH206-TPXREF101
https://developer.apple.com/library/prerelease/content/technotes/tn2326/_index.html
https://developer.apple.com/library/content/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW57
https://developer.apple.com/library/content/documentation/Security/Conceptual/CertKeyTrustProgGuide/revisionHistory/revisionHistory.html#//apple_ref/doc/uid/TP40001358-CH206-TPXREF101
https://developer.apple.com/library/content/technotes/tn2232/_index.html#//apple_ref/doc/uid/DTS40012884-CH1-SECBASICTRUSTCUSTOMIZATION
http://www.itdecent.cn/p/2542c95fb023
http://www.cnblogs.com/longshiyVip/p/5080917.html
http://www.itdecent.cn/p/e767a4e9252e
http://www.cnblogs.com/hyddd/archive/2009/01/07/1371292.html
https://developer.apple.com/library/content/qa/qa1727/_index.html
https://developer.apple.com/reference/security
