ios https单向验证

版权声明：本文为博主原创文章，未经博主允许不得转载。

https是http+tls。是在http和tcp之间添加了一层ssl加密验证,ssl将http发送的信息在将要发到传输层时进行了加密，同样数据从传输层到达http层时需要ssl解密。

如果iOS通过https访问的站点（服务器）证书是ca机构颁发的话，不需要多余的代码，请求以前http的时候怎么写现在还怎么写，只是把请求url的http改成https，但是如果站点的证书是自签证书（如通过java keytool自生成），ios默认是验证不通过的，请求会失败，那么需要在http请求回调里面做两步多余的处理，回调如下：

//证书验证处理
- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge;
//信任自签证书站点
- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace;

具体代码：

- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
    if (([challenge.protectionSpace.authenticationMethod
          isEqualToString:NSURLAuthenticationMethodServerTrust])) {
        if ([challenge.protectionSpace.host isEqualToString:TRUSTED_HOST]) {//TRUSTED_HOST主机名
            NSLog(@"Allowing bypass...");
            NSURLCredential *credential = [NSURLCredential credentialForTrust:
                                           challenge.protectionSpace.serverTrust];
            [challenge.sender useCredential:credential
                 forAuthenticationChallenge:challenge];
        }
    }
    [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
}
- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace
{
    return [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust];
}

这两个回调相当于做了https请求的全局设置，设置的作用是信任该站点的证书，一般在第一次发https请求的时候设置信任，以后客户端就可以和服务端正常地进行https通信了。

ios原生和uiwebview h5发送https请求的问题都可以通过上面代码处理，uiwebview一样对不信任证书站点会访问失败，原生里面做了对该站点的信任后对h5同样有效，也就是说一旦原生http请求对该站点信任则h5对该站点的访问也会正常。在stackoverflow上面看到一个例子，就是只有uiwebview控件需要对不信任证书站点访问的一种处理方式，既在uiviewview第一次发送https请求的时候在回调里面取消掉这次请求，既在shouldStartLoadWithRequest这个uiwebview回调的时候返回no，并同时用原生http去请求这个地址，并处理回调
设置信任后在原生请求即将收到信息回复的时候（即didReceiveResponse）取消掉该请求，并让uiwebview重新请求。这样信任了站点以后uiwebview请求该站点都可以成功。具体代码来自stackoverflow(http://stackoverflow.com/questions/11573164/uiwebview-to-view-self-signed-websites-no-private-api-not-nsurlconnection-i)：

#pragma mark - Webview delegate

// Note: This method is particularly important. As the server is using a self signed certificate,
// we cannot use just UIWebView - as it doesn't allow for using self-certs. Instead, we stop the
// request in this method below, create an NSURLConnection (which can allow self-certs via the delegate methods
// which UIWebView does not have), authenticate using NSURLConnection, then use another UIWebView to complete
// the loading and viewing of the page. See connection:didReceiveAuthenticationChallenge to see how this works.
- (BOOL)webView:(UIWebView *)webView shouldStartLoadWithRequest:(NSURLRequest *)request navigationType:(UIWebViewNavigationType)navigationType;
{
    NSLog(@"Did start loading: %@ auth:%d", [[request URL] absoluteString], _authenticated);

    if (!_authenticated) {
        _authenticated = NO;

        _urlConnection = [[NSURLConnection alloc] initWithRequest:_request delegate:self];

        [_urlConnection start];

        return NO;
    }

    return YES;
}


#pragma mark - NURLConnection delegate

- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge;
{
    NSLog(@"WebController Got auth challange via NSURLConnection");

    if ([challenge previousFailureCount] == 0)
    {
        _authenticated = YES;

        NSURLCredential *credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust];

        [challenge.sender useCredential:credential forAuthenticationChallenge:challenge];

    } else
    {
        [[challenge sender] cancelAuthenticationChallenge:challenge];
    }
}

- (void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)response;
{
    NSLog(@"WebController received response via NSURLConnection");

    // remake a webview call now that authentication has passed ok.
    _authenticated = YES;
    [_web loadRequest:_request];

    // Cancel the URL connection otherwise we double up (webview + url connection, same url = no good!)
    [_urlConnection cancel];
}

// We use this method is to accept an untrusted site which unfortunately we need to do, as our PVM servers are self signed.
- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace
{
    return [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust];
}

单向验证的原理网上很多，大致流程就是客户端第一次发送https请求到服务端，服务端将证书发送给客户端，该证书包含了公钥和证书的信息，客户端进行证书验证，验证颁发机构是否合法，是否过期，加密方式等。如果验证成功则生成一个随机值（秘钥），该值用来和服务端进行对称加密通信，并用公钥加密，发送给服务端。服务器用证书里的私钥解密获得客户端的密钥，然后服务端和客户端就可以进行https通信了。
个人认为ssl的处理逻辑是客户端会将验证后生成的秘钥保存在本地的某文件里，并在客户端发送https请求时从文件里读取密钥并用证书规定的加密方式加密，然后发送给传输层传输。

AFNetwork添加证书验证

    // /先导入证书
    NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"xxx" ofType:@"cer"];//证书的路径
    NSData *certData = [NSData dataWithContentsOfFile:cerPath];
    
    // AFSSLPinningModeCertificate 使用证书验证模式
    AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
    
    // allowInvalidCertificates 是否允许无效证书（也就是自建的证书），默认为NO
    // 如果是需要验证自建证书，需要设置为YES
    securityPolicy.allowInvalidCertificates = YES;
    securityPolicy.validatesDomainName = NO;
    
    securityPolicy.pinnedCertificates = @[certData];

使用Keytool生成证书：

1、为服务器生产证书：

keytool -genkey -keyalg RSA -dname "cn=127.0.0.1,ou=inspur,o=none,l=hunan,st=changsha,c=cn" -alias server -keypass 111111 -keystore server.keystore -storepass 111111 -validity 3650

cn改成你服务器地址

 l:省份

st:城市

2、生成csr

csr是用于提交CA认证的文件

keytool -certReq -alias server -keystore server.keystore -file ca.csr

3、生成cer

生成的ca.cer文件用于客户端证书导入信任服务器

keytool -export -alias server -keystore server.keystore -file ca.cer -storepass 111111

4、tomcat配置

<Connector SSLEnabled="true" clientAuth="false"
        maxThreads="150" port="8443"
        protocol="org.apache.coyote.http11.Http11Protocol"
        scheme="https" secure="true" sslProtocol="TLS"
        keystoreFile="/User/xxx/server.keystore" keystorePass="111111"/>

keystoreFile为文件路径

配置好后，重启tomcat可以使用https访问web工程，端口8443。