在 iOS 问题上读取证书

Question

我正在尝试从 iOS 中的各种 URL 读取证书。然而，我的代码运行不正常——应该返回我需要的信息的数组总是返回null。

我错过了什么？

- (void)findCertificate:(NSString *)url
{
    NSInputStream*input = [[NSInputStream inputStreamWithData:[NSData dataWithContentsOfURL:[NSURL URLWithString:@"https://store.writeitstudios.com"]]] retain];

    [input setDelegate:self];

    [input scheduleInRunLoop:[NSRunLoop mainRunLoop] forMode:NSDefaultRunLoopMode];

    [input open];

    NSLog(@"Status: %i",[input streamStatus]);
}

- (void)stream:(NSStream *)aStream handleEvent:(NSStreamEvent)eventCode
{
    NSLog(@"handle Event: %i",eventCode);

    if (eventCode == NSStreamStatusOpen)
    {
        NSArray *certificates = (NSArray*)CFReadStreamCopyProperty((CFReadStreamRef)aStream, kCFStreamPropertySSLPeerCertificates); 

        NSLog(@"Certs: %@",CFReadStreamCopyProperty((CFReadStreamRef)aStream, kCFStreamPropertySSLPeerCertificates));

        if ([certificates count] > 0) { 
            SecCertificateRef certificate = (SecCertificateRef)[certificates objectAtIndex:0]; 
            NSString *description = (NSString*)SecCertificateCopySubjectSummary(certificate); 
            NSData *data = (NSData *)SecCertificateCopyData(certificate); 
            NSLog(@"Description: %@",description);
        }
    }
}

是的，我知道我正在泄漏内存。这只是一个sn-p。

Answer 1

让我解释一下你在这里做什么以及为什么错了：

1. 您正在将 URL https://store.writeitstudios.com（即 HTML）的内容同步加载到 NSData（数据缓冲区）中。请注意，您没有加载任何证书（好吧，从技术上讲，NSURL 将在内部加载它们，但这段代码绝对不会将它们放入 NSData）
2. 您正在打开一个输入流并将数据（一些 HTML，没有证书！）粘贴到其中。
3. 您已实现NSStream 的委托方法stream:handleEvent: 并正在尝试读取kCFStreamPropertySSLPeerCertificates 属性。此属性将为空，因为流仅包含一点 HTML 数据，没有其他内容。
4. 您正在将空属性转换为 NSArray。
5. 没有执行循环，因为数组是NULL。

手头的任务不需要使用NSStream/CFStream。而且绝对不必先通过NSURLConnection，然后再通过NSStream。

要检索 SSL 服务器证书，请坚持使用简单的异步 NSURLConnection 并使用其委托方法来访问证书：

// Method to begin the asynchronous download

- (void)beginCertificateDownload:(NSURL *)url
{
    NSURLRequest *request = [NSURLRequest requestWithURL:url];
    NSURLConnection *connection = [[NSURLConnection alloc] initWithRequest:request delegate:self];

    [connection start];
}

// NSURLConnection Delegate Methods

- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace 
{
    return [[protectionSpace authenticationMethod] isEqualToString:NSURLAuthenticationMethodServerTrust];
}

- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
{
    // extract the certificates
    SecTrustRef trustRef = [[challenge protectionSpace] serverTrust];
    CFIndex count = SecTrustGetCertificateCount(trustRef);
    for (CFIndex i = 0; i < count; i++) {
        SecCertificateRef certRef = SecTrustGetCertificateAtIndex(trustRef, i);
        CFStringRef certSummary = SecCertificateCopySubjectSummary(certRef); 
        NSLog(@"%@", certSummary);

        // do whatever you need with the certificates here
        // don't forget to copy them if you need to keep them
        // around beyond the scope of this method
    }

    // I'm assuming you're not interested in actually loading the contents of the URL, so cancel
    [[challenge sender] cancelAuthenticationChallenge:challenge];

    // you'll also want to release the connection object at some point
}