iOS9 使用自签证证书实现HTTPS

公司的服务器被人DDOS攻击了,后台改用自签证的证书,全部请求改用HTTPS. iOS的网络请求也需要全部改. 坑爹的是项目中有两套请求方案. 1,使用原始苹果自带的NSURLConnection 2, 是我接手以后改用的afnetworking. 要全部改的话一下子没那么多时间改的过来. 就只好两个方案都实现下HTTPS

• afnetworking 使用字签证证书访问HTTPS
• 把服务器给你的自签证的证书放入bundle一般是.cer文件
• 创建afnnetworking 安全策略对象,并设置发起请求manager的安全策略属性.设置了安全策略属性,afnnetworking会自动扫描bundl里的证书.
• 最坑的是 iOS9新出的App Transport Security 也就是要我们把所有请求从 HTTP改成HTTPS的家伙, 它竟然不认自签证的证书. 苹果大爷难道真是土豪惯了,以为我们开发者都会买ca的证书吗. 解决办法就是那里还是要设置在Info.plist中添加NSAppTransportSecurity类型Dictionary在NSAppTransportSecurity下添加NSAllowsArbitraryLoads类型 Boolean,值设为YES

   //创建安全策略对象
    AFSecurityPolicy * security = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate]; //设置证书
    security.allowInvalidCertificates = YES;  // 由于是自签证证书 afnnetworking 会认为是无效的 设置为允许
    security.validatesDomainName = NO; //验证证书绑定的域
    [[AFHTTPRequestOperationManager manager]setSecurityPolicy:security]; //
    
    //普通一样发起请求就可以
    [[AFHTTPRequestOperationManager manager] POST:@"/test" parameters:nil success:^(AFHTTPRequestOperation *operation, id responseObject) {
        
    } failure:^(AFHTTPRequestOperation *operation, NSError *error) {
        
    }];

• NSURLConnection 使用自签证证书支持HTTPS,只需要在实现NSURLConnection的代理方法即可. 这个解决方法转自GitHub JacksonTian 他原文中有多了行释放代码 CFRelease(trust); ,多了这行代码在短时间重复请求,一个URL的时候trust 会提前释放导致crash,没有细究原因,直接注释掉了.

#pragma Support NSURLCONNECTION HTTPS

- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace{
    
    return [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust];
}

- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
{
    static CFArrayRef certs;
    if (!certs) {
        //创建证书data
        NSData*certData =[NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"HTTPS" ofType:@"cer"]];
        
        SecCertificateRef rootcert = SecCertificateCreateWithData(kCFAllocatorDefault,CFBridgingRetain(certData));
        const void *array[1] = { rootcert };
        certs = CFArrayCreate(NULL, array, 1, &kCFTypeArrayCallBacks);
//        CFRelease(rootcert);    // for completeness, really does not matter
    }
    
    SecTrustRef trust = [[challenge protectionSpace] serverTrust];
    int err;
    SecTrustResultType trustResult = 0;
    err = SecTrustSetAnchorCertificates(trust, certs);
    if (err == noErr) {
        err = SecTrustEvaluate(trust,&trustResult);
    }
//    BOOL trusted = (err == noErr) && ((trustResult == kSecTrustResultProceed)||(trustResult == kSecTrustResultConfirm) || (trustResult == kSecTrustResultUnspecified));
    BOOL trusted = (err == noErr) && ((trustResult == kSecTrustResultProceed) || (trustResult == kSecTrustResultUnspecified));
 
    if (trusted) {
        
        [challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
    }
    else{
        
        [challenge.sender cancelAuthenticationChallenge:challenge];
    }
    
//    CFRelease(trust);

}

********后面通过测试****, ****不实现上面的委托****, NSURLConnection ****也可以直接连接****HTTPS****服务器****, ****这种是绕过了证书的****. afnetworking ****不设置安全策略就无法访问****HTTPS****服务器****.****注****:afnnetworking****版本使用的是****2.5.4 ,****之前的版本关于安全策略的****API****有****bug ****在****afn****的****issue****中看到********