防止 ios5 中的自签名 ssl 证书

Question

我使用执行基本 HTTP 身份验证的代码，见下文。这在 IOS 5 中运行良好。但是现在我们将协议更改为 https，并且我们使用了伪造的自签名证书。它也奏效了！这似乎不安全。有人知道您是否需要在这种方法中做一些事情来防止某些证书被接受？

- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:
       (NSURLAuthenticationChallenge *)challenge {

if ([challenge previousFailureCount] <= maxRetryCount ) {
    NSURLCredential *newCredential =
    [NSURLCredential
     credentialWithUser: userName
     password:password
     persistence:NSURLCredentialPersistenceForSession];

    [[challenge sender]
     useCredential:newCredential
     forAuthenticationChallenge:challenge];

   }
   else
   {
     NSLog(@"Failure count %d",[challenge previousFailureCount]);
   }
}

Answer 1

看来我自己找到了答案。这会阻止无效证书。 使用有效证书登录时仍然需要测试它是否有效。

- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:
       (NSURLAuthenticationChallenge *)challenge {

   if ([[[challenge protectionSpace] authenticationMethod] isEqualToString:@"NSURLAuthenticationMethodServerTrust"]) {
      [[challenge sender] performDefaultHandlingForAuthenticationChallenge:challenge];
   }
   else {
      if ([challenge previousFailureCount] <= maxRetryCount ) {
        NSURLCredential *newCredential =
        [NSURLCredential
         credentialWithUser: userName
         password:password
         persistence:NSURLCredentialPersistenceForSession];

        [[challenge sender]
         useCredential:newCredential
         forAuthenticationChallenge:challenge];

       }
       else
       {
         NSLog(@"Failure count %d",[challenge previousFailureCount]);
       }
   }
}