ios9自签名证书和应用程序传输安全性 [英] ios9 self signed certificate and app transport security
问题描述
我花了一段时间尝试使它正常工作.我有一个要连接到的API,我正尝试使用自签名证书切换到SSL.我可以控制服务器和应用程序.
I've spent a while trying to get this working. I have an API that I'm connecting to that i'm trying to switch to SSL with self signed certificates. I have control on the server and app.
我据此生成了一个自签名证书:
I generated a self signed cert according to this:
https://kyup.com/tutorials/create-ssl-certificate-nginx /
sudo openssl genrsa -des3 -out ssl.key 2048
sudo openssl req -new -key ssl.key -out ssl.csr
sudo cp ssl.key ssl.key.orig & sudo openssl rsa -in ssl.key.orig -out ssl.key
sudo openssl x509 -req -days 365 -in ssl.csr -signkey ssl.key -out ssl.crt
我在服务器(NGINX)上尝试了一些配置选项
I've tried some config options on the server (NGINX)
ssl on;
ssl_certificate /etc/nginx/ssl/ssl.crt;
ssl_certificate_key /etc/nginx/ssl/ssl.key;
ssl_session_timeout 5m;
ssl_protocols SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
#ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
ssl_prefer_server_ciphers on;
在客户端,我尝试使用ATS进行一些其他选择:
And on the client side I've tried some different options with ATS:
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<true/>
</dict>
和
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<true/>
<key>NSExceptionDomains</key>
<dict>
<key>test.example.com (NOT REALLY MY DOMAIN)</key>
<dict>
<key>NSExceptionAllowsInsecureHTTPLoads</key>
<true/>
</dict>
</dict>
</dict>
和
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<true/>
<key>NSExceptionDomains</key>
<dict>
<key>test.example.com (NOT REALLY MY DOMAIN)</key>
<dict>
<key>NSExceptionAllowsInsecureHTTPLoads</key>
<true/>
<key>NSExceptionRequiresForwardSecrecy</key>
<false/>
<key>NSExceptionMinimumTLSVersion</key>
<string>TLSv1.1</string>
</dict>
</dict>
</dict>
根据不同的ATS选项,我会收到错误消息:
Depending on different ATS options I get errors:
An SSL error has occurred and a secure connection to the server cannot be made.
或
NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)
The certificate for this server is invalid. You might be connecting to a server that is pretending to be "MYDOMAIN" which could put your confidential information at risk.
有什么想法吗?还有其他人在与自己签名的证书作斗争吗?
Any ideas? Anyone else struggle with self signed certs?
P.S.我使用的是OS X 10.11.2 Beta,Xcode 7.1.1
P.S. I'm on OS X 10.11.2 Beta, Xcode 7.1.1
推荐答案
我发现了问题所在.它与App Transport Security无关.我必须确保iOS信任证书,因为它不是来自受信任的机构.
I figured out the issue. It has nothing to do with App Transport Security. I had to make sure that iOS trusts the certificate since it's not from a trusted authority.
通过重写NSURLRequest.allowsAnyHTTPSCertificateForHost的旧方法无法正常工作.
The old school way of doing this by overriding NSURLRequest.allowsAnyHTTPSCertificateForHost doesn't work.
由于我使用的是NSURLSession,因此必须这样做:
Since i'm using NSURLSession you have to do it with this:
- (id) init {
self = [super init];
NSURLSessionConfiguration * config = [NSURLSessionConfiguration defaultSessionConfiguration];
self.session = [NSURLSession sessionWithConfiguration:config delegate:self delegateQueue:[NSOperationQueue mainQueue]];
return self;
}
- (void) URLSession:(NSURLSession *)session didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential * _Nullable))completionHandler {
completionHandler(NSURLSessionAuthChallengeUseCredential,[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust]);
}
这篇关于ios9自签名证书和应用程序传输安全性的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!