ssl-p12

最新推荐文章于 2024-07-13 15:49:26 发布

原创最新推荐文章于 2024-07-13 15:49:26 发布 · 493 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#nsstring

iOS 之旅专栏收录该内容

171 篇文章

订阅专栏

本文介绍了一个iOS应用如何从资源文件中加载并使用.p12证书文件进行SSL连接配置的过程。文章详细展示了通过Objective-C代码实现的证书读取、导入、身份验证及证书拷贝等步骤，并最终设置SSL安全级别。

-(void)startSSL{
     // Read .p12 file
    NSString *path = [[NSBundle mainBundle] pathForResource:@"cloudscreen-prod" ofType:@"p12"];
    NSData *pkcs12data = [[NSData alloc] initWithContentsOfFile:path];

     // Import .p12 data
    CFArrayRef keyref = NULL;
    OSStatus sanityChesk = SecPKCS12Import((__bridge CFDataRef)pkcs12data,
                                           (__bridge CFDictionaryRef)[NSDictionary
                                                                      dictionaryWithObject:@"3437563"
                                                                      forKey:(__bridge id)kSecImportExportPassphrase],
                                           &keyref);

    if (sanityChesk != noErr) {

        NSLog(@"Error while importing pkcs12 [%@]", [[NSNumber numberWithInt:sanityChesk]stringValue]);
    } //else
    //        NSLog(@"Success opening p12 certificate.");

    // Identity
    CFDictionaryRef identityDict = CFArrayGetValueAtIndex(keyref, 0);
    SecIdentityRef identityRef = (SecIdentityRef)CFDictionaryGetValue(identityDict,kSecImportItemIdentity);
        // Cert
    SecCertificateRef cert = NULL;
    OSStatus status = SecIdentityCopyCertificate(identityRef, &cert);
    if (status)
        NSLog(@"SecIdentityCopyCertificate failed.");

    // the certificates array, containing the identity then the root certificate
    NSArray *myCerts = [[NSArray alloc] initWithObjects:(__bridge id)identityRef, (__bridge id)cert, nil];

    NSDictionary *sslset = [NSMutableDictionary dictionaryWithObjectsAndKeys:
                            (id)kCFBooleanFalse,kCFStreamSSLValidatesCertificateChain,
                            myCerts,kCFStreamSSLCertificates,
                            //                            @"192.168.0.121", kCFStreamSSLPeerName,
                            kCFStreamSocketSecurityLevelNegotiatedSSL,kCFStreamSSLLevel,
                            kCFStreamSocketSecurityLevelNegotiatedSSL,kCFStreamPropertySocketSecurityLevel,
                            kCFBooleanTrue,kCFStreamPropertyShouldCloseNativeSocket,
                            kCFBooleanFalse,kCFStreamSSLIsServer,
                            nil];
}