4

我正在使用 iOS 10。我正在评估自签名证书，如下所示

-(void) connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
    NSURLProtectionSpace *protectionSpace = [challenge protectionSpace];

    if ([protectionSpace authenticationMethod] == NSURLAuthenticationMethodServerTrust) {

        SecTrustRef trust = [protectionSpace serverTrust];

        SecPolicyRef policyOverride = SecPolicyCreateSSL(true, (CFStringRef)@"HOSTNAME");
        SecTrustSetPolicies(trust, policyOverride);

        CFMutableArrayRef certificates = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);

        /* Copy the certificates from the original trust object */
        CFIndex count = SecTrustGetCertificateCount(trust);
        CFIndex i=0;
        for (i = 0; i < count; i++) {
            SecCertificateRef item = SecTrustGetCertificateAtIndex(trust, i);
            CFArrayAppendValue(certificates, item);
        }

        /* Create a new trust object */
        SecTrustRef newtrust = NULL;
        if (SecTrustCreateWithCertificates(certificates, policyOverride, &newtrust) != errSecSuccess) {
            /* Probably a good spot to log something. */
            NSLog(@"Error in SecTrustCreateWithCertificates");
            [connection cancel];
            return;
        }

        CFRelease(policyOverride);

        /* Re-evaluate the trust policy. */
        SecTrustResultType secresult = kSecTrustResultInvalid;
        if (SecTrustEvaluate(trust, &secresult) != errSecSuccess) {

            /* Trust evaluation failed. */
            [connection cancel];

            // Perform other cleanup here, as needed.
            return;
        }

        switch (secresult) {
                //case kSecTrustResultInvalid:
                //case kSecTrustResultRecoverableTrustFailure:
            case kSecTrustResultUnspecified: // The OS trusts this certificate implicitly.
            case kSecTrustResultProceed: // The user explicitly told the OS to trust it.
            {
                NSURLCredential *credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust];
                [challenge.sender useCredential:credential forAuthenticationChallenge:challenge];

                return;
            }
            default: ;
                /* It's somebody else's key. Fall through. */
                [challenge.sender performDefaultHandlingForAuthenticationChallenge:challenge];
                break;
        }
        /* The server sent a key other than the trusted key. */
        [connection cancel];
        // Perform other cleanup here, as needed.
    }
}

评估后的结果是“ kSecTrustResultUnspecified”，并且再次willSendRequestForAuthenticationChallenge递归调用相同的方法“”。不确定为什么递归调用该方法。让我知道代码的任何问题。

谢谢

4

2 回答 2

1

有几个解决方案，我认为最简单的一个可以在这里找到。总之，您需要检查[challenge previousFailureCount]以防止一遍又一遍地重新输入方法。

否则，从 Apple API 文档中，我会建议类似于this的内容，它使用已弃用的委托回调，但可能对您有用。

于 2016-10-12T09:33:26.537 回答
0

它实际上是递归调用的。您的代码应该处理这个问题。

起初看起来很奇怪，但它有点道理......尝试验证，失败，所以它回到相同的方法（谁知道，也许你想尝试不同的凭证或其他东西）。

您可以检查先前的失败计数并自己拒绝它，否则它将失败并继续返回您的函数以递归方式进行身份验证，就像目前正在发生的那样。

于 2016-10-14T03:51:02.723 回答