Знайте общее имя из сертификата SSL

Question

Я очень новичок в этой области ... Я хочу проверить CN в сертификате SSL-сервера ... как мне этого добиться? Я использую методы делегата NSURLConnection canAuthenticateAgainstProtectionSpace и didReceiveAuthenticationChallenge.

Answer 1

Используйте 2 метода делегата ниже и включите Security.framework, и замените KNOWN-COMMON-NAME на ваше обычное имя сертификата.

-(void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge{
if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]){
    SecTrustRef trustRef = [[challenge protectionSpace] serverTrust];
    SecTrustEvaluate(trustRef, NULL);
    CFIndex count = SecTrustGetCertificateCount(trustRef); 
    BOOL trust = NO;
    if(count > 0){
        SecCertificateRef certRef = SecTrustGetCertificateAtIndex(trustRef, 0);
        CFStringRef certSummary = SecCertificateCopySubjectSummary(certRef);
        NSString* certSummaryNs = (NSString*)certSummary;
        if([certSummaryNs isEqualToString:@"KNOWN-COMMON-NAME"]){ // split host n
            trust = YES;
        }else{
            NSLog(@"Certificate name does not have required common name");
        }
        CFRelease(certSummary);
    }
    if(trust){
        [challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
    }else{
        [challenge.sender cancelAuthenticationChallenge:challenge];
    }
}
[challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
}

- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace {
    return [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust];
}

Answer 2

Начиная с iOS 10.3 в среде безопасности доступна функция :

CFStringRef commonNameRef = NULL;

// Check if function is available (iOS 10.3 and above)
if (SecCertificateCopyCommonName) {
    SecCertificateCopyCommonName(certificateRef, &commonNameRef);
}

NSString *commonName = CFBridgingRelease(commonNameRef);