客戶端證書和NSURLSession

好吧，我對SSL證書和身份驗證的廣泛奇觀很陌生，所以我可能在這裏做了非常明顯的錯誤。但我試圖設置一個NSURLSession來通過SSL網關從代理服務器上下載文件。由於我們構建的解決方案涉及的原因，我們希望使用非標準的CA來簽署證書。因此我有一個CACert，服務器證書和一個服務器私鑰。這些已被加入到我加載的pkcs12文件中，以從文件中獲取身份，然後我嘗試使用該證書進行安全信任評估。客戶端證書和NSURLSession

我得到的是，如果我連接到使用公共簽名證書的服務器，那麼服務器信任身份驗證工作得很好，我得到我期待的回調。所以我知道我已經正確地完成了委託連接。

但是，在代碼中指示的測試URL上出現客戶端證書質詢時，我得到一個-9802錯誤。這表明無論是正在評估證書或我有其他錯誤。事實上，服務器試圖轉向ServerTrust，然後將所有內容捲起來。（但奇怪的是該didBecomeInvalidWithError回調不會被調用，事事不順心，我期待。）

我已經把CFNetworking診斷上和設備日誌最終看起來像這樣： -

Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:2] 15:38:38.524 { 
    AddCookies Continue: request GET https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001 HTTP/1.1 
     HTTPProtocol: Task: 14dcc7c0 
    } [3:2] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:3] 15:38:38.526 { 
    Protocol Enqueue: request GET https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001 HTTP/1.1 
      Request: <CFURLRequest 0x14f48f60 [0x38002170]> {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} 
      Message: GET https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001 HTTP/1.1 
      Sending: dict [4] { 
         Accept-Encoding: gzip, deflate 
         Accept-Language: en-us 
           Accept: */ 
        } 
    } [3:3] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:4] 15:38:38.533 { 
    SocketStream IO Logging 
    } [3:4] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:5] 15:38:38.544 { 
    TCP Connection Created 
    conn: 0x14f53d10 for name 103.20.137.69, port 444 
    } [3:5] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:6] 15:38:38.548 { 
    TCP Connection Start 
    conn: 0x14f53d10 
    } [3:6] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:7] 15:38:38.610 { 
    SocketStream TCP Connection Complete 
    conn: 0x14f53d10 
    fd: 7 
    error: 0 
    } [3:7] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:8] 15:38:38.613 { 
    { fd: 7, local 10.47.29.209:53929 => peer 103.20.137.69:444 } RAW-SENT 201 
    RAW-SENT (7) | > data [ 201 ] bytes { 
    RAW-SENT (7) | > 00000000: 1603 0300 c401 0000 c003 0358 1168 ae99 ...........X.h.. 
    RAW-SENT (7) | > 00000010: 94f9 5ed2 d848 bb05 c846 5654 71c9 e3c9 ..^..H...FVTq... 
    RAW-SENT (7) | > 00000020: cd65 210b a324 dacc 75e2 a900 0018 00ff .e!..$..u....... 
    RAW-SENT (7) | > 00000030: c02c c02b c024 c00a c023 c009 c030 c02f .,.+.$.-.#...0./ 
    RAW-SENT (7) | > 00000040: c028 c027 c013 0100 007f 0000 0012 0010 .(.'............ 
    RAW-SENT (7) | > 00000050: 0000 0d31 3033 2e32 302e 3133 372e 3639 ..-103.20.137.69 
    RAW-SENT (7) | > 00000060: 000a 0008 0006 0017 0018 0019 000b 0002 .-.............. 
    RAW-SENT (7) | > 00000070: 0100 000d 000e 000c 0501 0401 0201 0503 ...-............ 
    RAW-SENT (7) | > 00000080: 0403 0203 3374 0000 0010 0030 002e 0268 ....3t.....0...h 
    RAW-SENT (7) | > 00000090: 3205 6832 2d31 3605 6832 2d31 3505 6832 2.h2-16.h2-15.h2 
    RAW-SENT (7) | > 000000a0: 2d31 3408 7370 6479 2f33 2e31 0673 7064 -14.spdy/3.1.spd 
    RAW-SENT (7) | > 000000b0: 792f 3308 6874 7470 2f31 2e31 0005 0005 y/3.http/1.1.... 
    RAW-SENT (7) | > 000000c0: 0100 0000 0000 1200 00      .........   
    RAW-SENT (7) | > } 
    } [3:8] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:9] 15:38:38.617 { 
    ioLogger 
    logStruct: array [4] { 
       BEGIN SSL RECORD DECODE: SENT 
       decodeHandshake [0] @ 0x14f5d915, version 303, length 196 (0xc4) 
       ClientHello (1, 0x1), length 192 (0xc0) 
       END SSL RECORD DECODE: SENT 
      } 
    } [3:9] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:10] 15:38:38.718 { 
    { fd: 7, local 10.47.29.209:53929 => peer 103.20.137.69:444 } RAW-READ 1368 
    RAW-READ (7) | < data [ 1368 ] bytes { 
    RAW-READ (7) | < 00000000: 1603 0305 a002 0000 4d03 0358 1168 b65d ........M..X.h.] 
    RAW-READ (7) | < 00000010: 4b61 2b40 e5f7 65d5 bbea a3d1 ce5d 113f [email protected]].? 
    RAW-READ (7) | < 00000020: 86be 2d04 9288 fd34 2a86 d620 5811 68b6 ..-....4*.. X.h. 
    RAW-READ (7) | < 00000030: 51f5 0beb 192f 0954 9556 c1f8 6d18 1f4b Q..../.T.V..m..K 
    RAW-READ (7) | < 00000040: 5304 638c a110 b2f6 09ab cff2 c030 0000 S.c..........0.. 
    RAW-READ (7) | < 00000050: 05ff 0100 0100 0b00 042b 0004 2800 0242 .........+..(..B 
    RAW-READ (7) | < 00000060: 3082 023e 3082 01a7 a003 0201 0202 0821 0..>0..........! 
    RAW-READ (7) | < 00000070: 92e4 4931 8b9b ad30 0d06 092a 8648 86f7 ..I1...0-..*.H.. 
    RAW-READ (7) | < 00000080: 0d01 0105 0500 3025 3123 3021 0603 5504 -.....0%1#0!..U. 
    RAW-READ (7) | < 00000090: 030c 1a66 692d 706f 696e 7379 732d 7372 ...fi-poinsys-sr 
    RAW-READ (7) | < 000000a0: 762d 7465 7374 2d30 3031 2d63 6130 2017 v-test-001-ca0 . 
    RAW-READ (7) | < 000000b0: 0d30 3830 3332 3631 3335 3035 305a 180f -080326135050Z.. 
    RAW-READ (7) | < 000000c0: 3230 3538 3033 3236 3133 3530 3530 5a30 20580326135050Z0 
    RAW-READ (7) | < 000000d0: 2d31 2b30 2906 0355 0403 0c22 6669 2d70 -1+0)..U..."fi-p 
    RAW-READ (7) | < 000000e0: 6f69 6e73 7973 2d73 7276 2d74 6573 7467 oinsys-srv-testg 
    RAW-READ (7) | < 000000f0: 7731 2d30 3031 2d67 656e 6572 616c 3081 w1-001-general0. 
    RAW-READ (7) | < 00000100: 9f30 0d06 092a 8648 86f7 0d01 0101 0500 .0-..*.H..-..... 
    RAW-READ (7) | < 00000110: 0381 8d00 3081 8902 8181 00b4 1d0e 5f53 ....0........._S 
    RAW-READ (7) | < 00000120: 9179 2d45 80d2 4746 2164 1cac 8613 3e67 .y-E..GF!d....>g 
    RAW-READ (7) | < 00000130: 628c 2514 0036 e770 ca16 15ed 73da 5997 b.%..6.p....s.Y. 
    RAW-READ (7) | < 00000140: 2c10 5c5f ce84 4225 5857 20a5 04af 2879 ,.\_..B%XW ...(y 
    RAW-READ (7) | < 00000150: 661a b7c5 a9db b05c dd47 a996 63ed 58e6 f......\.G..c.X. 
    RAW-READ (7) | < 00000160: 4d7a 34f4 e4b7 26fb 87c8 a08b 48e9 b504 Mz4...&.....H... 
    RAW-READ (7) | < 00000170: 4e01 9aa9 aea4 fb02 93b6 0816 0a9b 1054 N...........-..T 
    RAW-READ (7) | < 00000180: 6d7b 2647 dd66 ade5 e0f4 79f1 3b01 7bbf m{&G.f....y.;.{. 
    RAW-READ (7) | < 00000190: 044a 6954 6be1 408a ce75 8302 0301 0001 [email protected] 
    RAW-READ (7) | < 000001a0: a36d 306b 3009 0603 551d 1304 0230 0030 .m0k0...U....0.0 
    RAW-READ (7) | < 000001b0: 5e06 0355 1d1f 0457 3055 3053 a051 a04f ^..U...W0U0S.Q.O 
    RAW-READ (7) | < 000001c0: 864d 6874 7470 733a 2f2f 706f 696e 7473 .Mhttps://points 
    RAW-READ (7) | < 000001d0: 736c 7465 7374 3a38 3434 332f 6b6d 732f sltest:8443/kms/ 
    RAW-READ (7) | < 000001e0: 6372 6c2f 6765 7463 726c 2e68 746d 6c3f crl/getcrl.html? 
    RAW-READ (7) | < 000001f0: 6e61 6d65 3d66 692d 706f 696e 7379 732d name=fi-poinsys- 
    RAW-READ (7) | < 00000200: 7372 762d 7465 7374 2d30 3031 2d63 6130 srv-test-001-ca0 
    RAW-READ (7) | < 00000210: 0d06 092a 8648 86f7 0d01 0105 0500 0381 -..*.H..-....... 
    RAW-READ (7) | < 00000220: 8100 13f7 5f61 4699 d11c 1199 87d6 964a ...._aF........J 
    RAW-READ (7) | < 00000230: 7e37 4454 94e6 3f8c 063f c560 68f3 4f89 ~7DT..?..?.`h.O. 
    RAW-READ (7) | < 00000240: 9f53 1521 5cf3 aa47 f57c 007a e54b 1b47 .S.!\..G.|.z.K.G 
    RAW-READ (7) | < 00000250: 8c98 eaaa 235b 3fcf 819a 3df9 5540 a67b ....#[[email protected]{ 
    RAW-READ (7) | < 00000260: 02f1 013a c2c7 a523 a679 438f 58b3 af01 ...:...#.yC.X... 
    RAW-READ (7) | < 00000270: 8a9e f3fb de96 ac7e 2d38 4216 a794 502e .......~-8B...P. 
    RAW-READ (7) | < 00000280: 1b7d 9ad5 cf3b 1ebe 745e c976 bb03 90f0 .}...;..t^.v.... 
    RAW-READ (7) | < 00000290: f8a7 4b81 5319 197f 221d 0d5f 504b c69a ..K.S...".-_PK.. 
    RAW-READ (7) | < 000002a0: 10aa 0001 e030 8201 dc30 8201 45a0 0302 .....0...0..E... 
    RAW-READ (7) | < 000002b0: 0102 0208 6c89 815a 8bf7 15f5 300d 0609 ....l..Z....0-.. 
    RAW-READ (7) | < 000002c0: 2a86 4886 f70d 0101 0505 0030 2531 2330 *.H..-.....0%1#0 
    RAW-READ (7) | < 000002d0: 2106 0355 0403 0c1a 6669 2d70 6f69 6e73 !..U....fi-poins 
    RAW-READ (7) | < 000002e0: 7973 2d73 7276 2d74 6573 742d 3030 312d ys-srv-test-001- 
    RAW-READ (7) | < 000002f0: 6361 3020 170d 3038 3033 3236 3133 3530 ca0 .-0803261350 
    RAW-READ (7) | < 00000300: 3530 5a18 0f32 3035 3830 3332 3631 3335 50Z..20580326135 
    RAW-READ (7) | < 00000310: 3035 305a 3025 3123 3021 0603 5504 030c 050Z0%1#0!..U... 
    RAW-READ (7) | < 00000320: 1a66 692d 706f 696e 7379 732d 7372 762d .fi-poinsys-srv- 
    RAW-READ (7) | < 00000330: 7465 7374 2d30 3031 2d63 6130 819f 300d test-001-ca0..0- 
    RAW-READ (7) | < 00000340: 0609 2a86 4886 f70d 0101 0105 0003 818d ..*.H..-........ 
    RAW-READ (7) | < 00000350: 0030 8189 0281 8100 859a a533 e990 210b .0.........3..!. 
    RAW-READ (7) | < 00000360: 58c1 8b58 984a fd75 337c c021 d374 02d8 X..X.J.u3|.!.t.. 
    RAW-READ (7) | < 00000370: f640 ff05 3efd a51a 9df7 f6eb 1023 52bc [email protected]>........#R. 
    RAW-READ (7) | < 00000380: ac59 a650 e4ad 9d1f 02e6 97db c914 a01b .Y.P............ 
    RAW-READ (7) | < 00000390: cd30 4945 8d71 5178 44f8 b4d4 9cba 2b8a .0IE.qQxD.....+. 
    RAW-READ (7) | < 000003a0: 9077 1d85 9547 9c49 a043 7879 6899 2048 .w...G.I.Cxyh. H 
    RAW-READ (7) | < 000003b0: 6fa5 d537 0010 0591 9d61 e854 5613 3d1d o..7.....a.TV.=. 
    RAW-READ (7) | < 000003c0: 4677 5f8a ddb8 8d4d a885 3984 1cd9 7550 Fw_....M..9...uP 
    RAW-READ (7) | < 000003d0: 96f4 acef 2a9f 7633 0203 0100 01a3 1330 ....*.v3.......0 
    RAW-READ (7) | < 000003e0: 1130 0f06 0355 1d13 0408 3006 0101 ff02 .0...U....0..... 
    RAW-READ (7) | < 000003f0: 0101 300d 0609 2a86 4886 f70d 0101 0505 ..0-..*.H..-.... 
    RAW-READ (7) | < 00000400: 0003 8181 007b a0cd 116b a28f b536 67bf .....{...k...6g. 
    RAW-READ (7) | < 00000410: f87e 7b61 7543 411a 6047 7ca9 e54a 1a36 .~{auCA.`G|..J.6 
    RAW-READ (7) | < 00000420: e688 cd15 e346 e519 3f46 f900 79a8 e027 .....F..?F..y..' 
    RAW-READ (7) | < 00000430: 43f9 b963 a0f6 81d0 26c5 f66d 9d88 017d C..c....&..m...} 
    RAW-READ (7) | < 00000440: 7c99 3168 2cf4 dced 64f8 5624 81d2 6dd2 |.1h,...d.V$..m. 
    RAW-READ (7) | < 00000450: aaf4 0a0f c21d e196 e557 196c 0686 d698 ..-......W.l.... 
    RAW-READ (7) | < 00000460: 5f6a 2d12 996c 3157 0ba7 ee35 498c db3a _j-..l1W...5I..: 
    RAW-READ (7) | < 00000470: 2835 34cb b6e5 b941 7fac bf9f cfaa 5b98 (54....A......[. 
    RAW-READ (7) | < 00000480: d118 ca76 360c 0000 c903 0017 4104 bf45 ...v6.......A..E 
    RAW-READ (7) | < 00000490: 344f 7916 08d2 fa31 ec81 ac4e 7baf bfe1 4Oy....1...N{... 
    RAW-READ (7) | < 000004a0: e04e 459d 2043 f3f9 8208 fce6 35ef bc99 .NE. C......5... 
    RAW-READ (7) | < 000004b0: b606 a4f7 19eb 3c16 7131 ade6 4952 1dc5 ......<.q1..IR.. 
    RAW-READ (7) | < 000004c0: 3b21 3cde ab1d c06f 870e 6580 9489 0501 ;!<....o..e..... 
    RAW-READ (7) | < 000004d0: 0080 9468 d320 2901 bcb4 07b9 691c c9b2 ...h.).....i... 
    RAW-READ (7) | < 000004e0: feae 734a dbb5 a658 a03f 93cb c769 2588 ..sJ...X.?...i%. 
    RAW-READ (7) | < 000004f0: 5e5d 011c 89bb dc6e 7d72 054e b173 c8f5 ^].....n}r.N.s.. 
    RAW-READ (7) | < 00000500: 90c1 c0db d0ee a59d c69e 8a0f 0195 3d7b ..............={ 
    RAW-READ (7) | < 00000510: c4f1 b067 5cb8 131c a79d ad43 0bc9 1cbd ...g\......C.... 
    RAW-READ (7) | < 00000520: c8f0 4f57 9fbb 4680 3afa 182f af23 bea9 ..OW..F.:../.#.. 
    RAW-READ (7) | < 00000530: 03dd c86d eb5a fae3 c449 a0b2 688e 4b0a ...m.Z...I..h.K- 
    RAW-READ (7) | < 00000540: 2188 f37b a27e 5fa2 4221 d52c a98b 7e90 !..{.~_.B!.,..~. 
    RAW-READ (7) | < 00000550: 5d81 0d00 004b 0301      ].-..K..   
    RAW-READ (7) | < } 
    } [3:10] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:11] 15:38:38.730 { 
    { fd: 7, local 10.47.29.209:53929 => peer 103.20.137.69:444 } RAW-READ 77 
    RAW-READ (7) | < data [ 77 ] bytes { 
    RAW-READ (7) | < 00000000: 0240 0016 0603 0601 0503 0501 0403 0401 [email protected] 
    RAW-READ (7) | < 00000010: 0303 0301 0203 0201 0202 002d 002b 3029 ...........-.+0) 
    RAW-READ (7) | < 00000020: 3127 3025 0603 5504 030c 1e66 692d 706f 1'0%..U....fi-po 
    RAW-READ (7) | < 00000030: 696e 7379 732d 7465 7374 636c 742d 636d insys-testclt-cm 
    RAW-READ (7) | < 00000040: 7331 2d30 3031 2d63 610e 0000 00   s1-001-ca....  
    RAW-READ (7) | < } 
    } [3:11] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:12] 15:38:38.732 { 
    ioLogger 
    logStruct: array [12] { 
       BEGIN SSL RECORD DECODE: READ 
       decodeHandshake [0] @ 0x15c62025, version 303, length 1440 (0x5a0) 
       ServerHello (2, 0x2), length 77 (0x4d) 
       decodeHandshake [1] @ 0x15c62076, version 303, length 1440 (0x5a0) 
       Certificate (11, 0xb), length 1067 (0x42b) 
       decodeHandshake [2] @ 0x15c624a5, version 303, length 1440 (0x5a0) 
       ServerKeyExchange (12, 0xc), length 201 (0xc9) 
       decodeHandshake [3] @ 0x15c62572, version 303, length 1440 (0x5a0) 
       CertificateRequest (13, 0xd), length 75 (0x4b) 
       decodeHandshake [4] @ 0x15c625c1, version 303, length 1440 (0x5a0) 
       ServerHelloDone (14, 0xe), length 0 (0x0) 
       END SSL RECORD DECODE: READ 
      } 
    } [3:12] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:13] 15:38:38.739 { 
    Client Cert Requested 
    Distinguished Names: 1 
        0: << DATA <CFData 0x14def8c0 [0x38002170]>{length = 43, capacity = 43, bytes = 0x30293127302506035504030c1e66692d ... 312d3030312d6361} >> 
    } [3:13] 
Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:14] 15:38:38.742 { 
    Authentication Challenge 
    Loader: <CFURLRequest 0x14dcb620 [0x38002170]> {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} 
    Challenge: challenge space https://103.20.137.69:444/, ClientCertificateRequested (Hash c3626e29) 
    } [3:14] 
Oct 27 15:38:38 Philip-Banks-ipod Unknown[791] <Error>: 
Oct 27 15:38:43 Philip-Banks-ipod MPEtestApplication[793] <Error>: SecTrustEvaluate [leaf AnchorTrusted] 
Oct 27 15:38:44 Philip-Banks-ipod MPEtestApplication[793] <Warning>: Certificates found: 1 
Oct 27 15:38:44 Philip-Banks-ipod MPEtestApplication[793] <Error>: SecTrustEvaluate [leaf AnchorTrusted] 
Oct 27 15:38:44 Philip-Banks-ipod MPEtestApplication[793] <Warning>: User: (null), certificates ( 
    "<cert(0x160214f0) s: 400-133-738-MOB i: fi-poinsys-testclt-cms1-001-ca>" 
) identity:<SecIdentityRef: 0x16020270> 
Oct 27 15:38:46 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:15] 15:38:46.070 { 
    Use Credential 
    Loader: <CFURLRequest 0x14dcb620 [0x38002170]> {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} 
    Credential: Name: 400-133-738-MOB, Persistence: permanent 
    } [3:15] 
Oct 27 15:38:46 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:16] 15:38:46.074 { 
    touchConnection 
      Loader: <CFURLRequest 0x14dcb620 [0x38002170]> {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} 
    Timeout Interval: 60.000 seconds 
    } [3:16] 
Oct 27 15:38:46 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:17] 15:38:46.078 { 
    Peer certificate 
    Subject Sum: fi-poinsys-srv-testgw1-001-general 
    Summary: fi-poinsys-srv-test-001-ca 
    } [3:17] 
Oct 27 15:38:46 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:18] 15:38:46.093 { 
    Authentication Challenge 
    Loader: <CFURLRequest 0x14dcb620 [0x38002170]> {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} 
    Challenge: challenge space https://103.20.137.69:444/, ServerTrustEvaluationRequested (Hash c3626e29) 
    } [3:18] 
Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:19] 15:38:47.250 { 
    Use Credential 
    Loader: <CFURLRequest 0x14dcb620 [0x38002170]> {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} 
    Credential: null 
    } [3:19] 
Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:20] 15:38:47.252 { 
    touchConnection 
      Loader: <CFURLRequest 0x14dcb620 [0x38002170]> {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} 
    Timeout Interval: 60.000 seconds 
    } [3:20] 
Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] <Error>: SecTrustEvaluate [leaf SSLHostname] [root AnchorTrusted] 
Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] <Warning>: NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802) 
Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:21] 15:38:47.255 { 
    Response Error 
    Request: <CFURLRequest 0x14f48f60 [0x38002170]> {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} 
    Error: Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFNetworkCFStreamSSLErrorOriginalValue=-9802, _kCFStreamPropertySSLClientCertificateState=2, _kCFStreamErrorCodeKey=-9802, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x14f76660>, _kCFStreamErrorDomainKey=3, kCFStreamPropertySSLPeerCertificates=<CFArray 0x160274c0 [0x38002170]>{type = immutable, count = 2, values = ( 
      0 : <cert(0x14f70280) s: fi-poinsys-srv-testgw1-001-general i: fi-poinsys-srv-test-001-ca> 
      1 : <cert(0x14f70520) s: fi-poinsys-srv-test-001-ca i: fi-poinsys-srv-test-001-ca> 
     )}, _kCFStreamPropertySSLClientCertificates=<CFArray 0x14f74740 [0x38002170]>{type = mutable-small, count = 2, values = ( 
      0 : <SecIdentityRef: 0x16020270> 
      1 : <cert(0x160214f0) s: 400-133-738-MOB i: fi-poinsys-testclt-cms1-001-ca> 
     )}} 
    } [3:21] 
Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:22] 15:38:47.258 { 
      Did Fail 
       Loader: <CFURLRequest 0x14dcb620 [0x38002170]> {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} 
       Error: Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFNetworkCFStreamSSLErrorOriginalValue=-9802, _kCFStreamPropertySSLClientCertificateState=2, _kCFStreamErrorCodeKey=-9802, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x14f76660>, _kCFStreamErrorDomainKey=3, kCFStreamPropertySSLPeerCertificates=<CFArray 0x160274c0 [0x38002170]>{type = immutable, count = 2, values = ( 
         0 : <cert(0x14f70280) s: fi-poinsys-srv-testgw1-001-general i: fi-poinsys-srv-test-001-ca> 
         1 : <cert(0x14f70520) s: fi-poinsys-srv-test-001-ca i: fi-poinsys-srv-test-001-ca> 
        )}, _kCFStreamPropertySSLClientCertificates=<CFArray 0x14f74740 [0x38002170]>{type = mutable-small, count = 2, values = ( 
         0 : <SecIdentityRef: 0x16020270> 
         1 : <cert(0x160214f0) s: 400-133-738-MOB i: fi-poinsys-testclt-cms1-001-ca> 
        )}} 
    init to origin load: 0.011323s 
      total time: 8.75724s 
     total bytes: 0 
    } [3:22] 
Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] <Notice>: CFNetwork Diagnostics [3:23] 15:38:47.275 { 
    ~HTTPProtocol: nullptr request 
     Request: null 
      sent: 0 
     received: 0 
    cell sent: 0 
    cell received: 0 
    } [3:23]

這似乎很清楚，認證失敗，但不是爲什麼失敗。我會很感激這裏的任何有用的建議，因爲我有點卡在這一點。

此代碼正在使用XCode 8構建，針對10 SDK並將其部署到iOS 9.3.5設備上。

這裏是有問題的代碼： -

#import "testSSLClass.h" 
@interface testSSLClass()<NSURLConnectionDelegate, NSURLSessionDelegate, NSURLSessionDataDelegate> { 
    NSString* mDownloadURL; 
    NSURLSessionConfiguration* mDownloadConfiguration; 
    NSURLSession* mDownloadSession; 
    NSURLSessionDataTask* mDownloadTask; 
    NSMutableData* mDataReceived; 
} 
@end 
@implementation testSSLClass 
-(instancetype)init 
{ 
    if (self = [super init]) 
    { 
    mDownloadURL = @"https://103.20.137.69:443/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001"; 
    mDownloadConfiguration = [NSURLSessionConfiguration ephemeralSessionConfiguration]; 
    } 
    return self; 
} 
-(void)doADownload 
{ 
    mDataReceived = [NSMutableData new]; 
    NSURL* URLtoFetch = [NSURL URLWithString:mDownloadURL]; 
    mDownloadSession = [NSURLSession sessionWithConfiguration:mDownloadConfiguration delegate:self delegateQueue:nil]; 
    mDownloadTask = [mDownloadSession dataTaskWithURL:URLtoFetch]; 
    [mDownloadTask resume]; 
} 
-(void)URLSession:(NSURLSession *)session didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential * _Nullable))completionHandler 
{ 
    if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) { 
    [self willSendRequestForAuthenticationChallenge:challenge completionHandler:completionHandler]; 
    } else { 
    completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil); 
    } 
} 
-(void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didReceiveData:(NSData *)data 
{ 
    [mDataReceived appendData:data]; 
} 
-(void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask willCacheResponse:(NSCachedURLResponse *)proposedResponse completionHandler:(void (^)(NSCachedURLResponse * _Nullable))completionHandler 
{ 
    [mDataReceived length]; 
} 
-(void)URLSession:(NSURLSession *)session didBecomeInvalidWithError:(NSError *)error 
{ 
    NSLog(@"Error: %@", [error userInfo]); 
} 
-(void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didBecomeStreamTask:(NSURLSessionStreamTask *)streamTask 
{ 
    NSLog(@"Did Become Stream Task"); 
} 

- (void)willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential * _Nullable))completionHandler 
{ 
    if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) 
    { 
    NSArray* paths = NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES); 
    NSString* directoryPath = [paths objectAtIndex:0]; 
    NSString* cacertPath = [directoryPath stringByAppendingPathComponent:@"client.p12"]; 
    NSData *p12data = [NSData dataWithContentsOfFile:cacertPath]; 

    CFDataRef inP12data = (__bridge CFDataRef)p12data; 

    SecIdentityRef myIdentity; 
    SecTrustRef myTrust; 
    extractIdentityAndTrust(inP12data, &myIdentity, &myTrust); 
    assert(myIdentity != nil); 
    assert(myTrust != nil); 

    long count = SecTrustGetCertificateCount(myTrust); 
    NSMutableArray* myCertificates = nil; 
    if(count > 0) { 
     myCertificates = [NSMutableArray arrayWithCapacity:count]; 
     for(int i = 0; i < count; ++i) { 
     [myCertificates addObject:(__bridge id)SecTrustGetCertificateAtIndex(myTrust, i)]; 
     } 
    } 

    SecTrustResultType trustResult; 
    OSStatus evalResult = SecTrustEvaluate(myTrust, &trustResult); 

    if (trustResult == kSecTrustResultRecoverableTrustFailure) 
    { 
     CFDataRef errDataRef = SecTrustCopyExceptions(myTrust); 
     SecTrustSetExceptions(myTrust, errDataRef); 

     evalResult = SecTrustEvaluate(myTrust, &trustResult); 
    } 
    NSURLCredential *credential = [NSURLCredential credentialWithIdentity:myIdentity certificates:myCertificates persistence:NSURLCredentialPersistencePermanent]; 
    assert(credential != nil); 

    NSLog(@"User: %@, certificates %@ identity:%@", [credential user], [credential certificates], [credential identity]); 
    [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge]; 
    completionHandler(NSURLSessionAuthChallengeUseCredential,credential); 
    } else { 
    completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil); 
    } 
} 
OSStatus extractIdentityAndTrust(CFDataRef inP12data, SecIdentityRef *identity, SecTrustRef *trust) 
{ 
    OSStatus securityError = errSecSuccess; 

    CFStringRef password = CFSTR("password"); 
    const void *keys[] = { kSecImportExportPassphrase }; 
    const void *values[] = { password }; 

    CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL); 

    CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL); 
    securityError = SecPKCS12Import(inP12data, options, &items); 

    if (securityError == 0) { 
    CFDictionaryRef myIdentityAndTrust = CFArrayGetValueAtIndex(items, 0); 
    const void *tempIdentity = NULL; 
    tempIdentity = CFDictionaryGetValue(myIdentityAndTrust, kSecImportItemIdentity); 
    *identity = (SecIdentityRef)tempIdentity; 
    const void *tempTrust = NULL; 
    tempTrust = CFDictionaryGetValue(myIdentityAndTrust, kSecImportItemTrust); 
    *trust = (SecTrustRef)tempTrust; 

    CFIndex count = CFArrayGetCount(items); 
    NSLog(@"Certificates found: %ld",count); 
    } 

    if (options) { 
    CFRelease(options); 
    } 

    return securityError; 
} 
@end

任何建議，提示或建議欣然接受。

菲利普

來源

2016-10-31 Philip Banks

本文可能會幫助您解決https://infinum.co/the-capsized-eight/articles/how-to-make-your-ios-apps-more-secure-with-ssl-pinning –

謝謝，我已閱讀。但是這似乎是ServerTrust身份驗證的證書鎖定。而我正在嘗試做ClientCertificate - 我想。 –

好了，經過一番來回一個有用的蘋果員工和敲打了幾個頭本地做證書在這一個明智的方式是我結束瞭解決方案： -

#import "testSSLClass.h" 

@interface testSSLClass()<NSURLConnectionDelegate, NSURLSessionDelegate, NSURLSessionDataDelegate> { 
    NSString* mDownloadURL; 
    NSURLSessionConfiguration* mDownloadConfiguration; 
    NSURLSession* mDownloadSession; 
    NSURLSessionDataTask* mDownloadTask; 
    NSMutableData* mDataReceived; 
} 


@end 

@implementation testSSLClass 

-(instancetype)init 
{ 
    if (self = [super init]) 
    { 
    mDownloadURL = @"https://your.server.url"; 
    mDownloadConfiguration = [NSURLSessionConfiguration ephemeralSessionConfiguration]; 
    } 
    return self; 
} 

-(void)doADownload 
{ 
    mDataReceived = [NSMutableData new]; 
    NSURL* URLtoFetch = [NSURL URLWithString:mDownloadURL]; 
    mDownloadSession = [NSURLSession sessionWithConfiguration:mDownloadConfiguration delegate:self delegateQueue:nil]; 
    mDownloadTask = [mDownloadSession dataTaskWithURL:URLtoFetch]; 
    [mDownloadTask resume]; 
} 

-(void)URLSession:(NSURLSession *)session didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential * _Nullable))completionHandler 
{ 
    if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) { 
    [self willSendRequestForAuthenticationChallenge:challenge completionHandler:completionHandler]; 
    } else { 
    completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil); 
    } 
} 

-(void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didReceiveData:(NSData *)data 
{ 
    NSLog(@"Appending data: %lu bytes", (unsigned long)[data length]); 
    [mDataReceived appendData:data]; 
} 

-(void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask willCacheResponse:(NSCachedURLResponse *)proposedResponse completionHandler:(void (^)(NSCachedURLResponse * _Nullable))completionHandler 
{ 
    // We got the data. 
    NSLog(@"Download finished: %lu bytes", (unsigned long)[mDataReceived length]); 
    completionHandler(NULL); 
} 

-(void)URLSession:(NSURLSession *)session didBecomeInvalidWithError:(NSError *)error 
{ 
    NSLog(@"Error: %@", [error userInfo]); 
} 

-(void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didBecomeStreamTask:(NSURLSessionStreamTask *)streamTask 
{ 
    NSLog(@"Did Become Stream Task"); 
} 

- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task didCompleteWithError:(NSError *)error 
{ 
    NSLog(@"Download finished: %lu bytes", (unsigned long)[mDataReceived length]); 
    if (error) { 
    NSLog(@"Error: %@", [error userInfo]); 
    } 
} 

#pragma NSURLConnection delegate 

-(void)connection:(NSURLConnection *)connection didFailWithError:(NSError *)error 
{ 
    NSLog(@"Error: %@", [error userInfo]); 
} 

- (void)willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential * _Nullable))completionHandler 
{ 
    if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) 
    { 
    NSArray* paths = NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES); 
    NSString* directoryPath = [paths objectAtIndex:0]; 
    NSString* cacertPath = [directoryPath stringByAppendingString:@"/client.p12"]; 

    NSData *p12data = [NSData dataWithContentsOfFile:cacertPath]; 

    CFDataRef inP12data = (__bridge CFDataRef)p12data; 

    SecIdentityRef myIdentity = nil; 
    extractIdentity(inP12data, &myIdentity); 
    assert(myIdentity != nil); 

    NSURLCredential* credential = [NSURLCredential credentialWithIdentity:myIdentity certificates:nil persistence:NSURLCredentialPersistenceNone]; 
    assert(credential != nil); 

    NSLog(@"User: %@, certificates %@ identity:%@", [credential user], [credential certificates], [credential identity]); 
    [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge]; 
    completionHandler(NSURLSessionAuthChallengeUseCredential,credential); 
    } else { 
    completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil); 
    } 
} 

OSStatus extractIdentity(CFDataRef inP12data, SecIdentityRef *identity) 
{ 
    OSStatus securityError = errSecSuccess; 

    CFStringRef password = CFSTR("password"); 
    const void *keys[] = { kSecImportExportPassphrase }; 
    const void *values[] = { password }; 

    CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL); 

    CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL); 
    securityError = SecPKCS12Import(inP12data, options, &items); 

    if (securityError == errSecSuccess) { 
    CFDictionaryRef myIdentityAndTrust = CFArrayGetValueAtIndex(items, 0); 
    const void *tempIdentity = NULL; 
    tempIdentity = CFDictionaryGetValue(myIdentityAndTrust, kSecImportItemIdentity); 
    *identity = (SecIdentityRef)tempIdentity; 

    CFIndex count = CFArrayGetCount(items); 
    NSLog(@"Certificates found: %ld",count); 
    } 

    if (options) { 
    CFRelease(options); 
    } 

    return securityError; 
} 

@end

我們使用本地下載的pkcs12格式文件，其中包含私鑰和證書以建立縮進。該證書現在正在由公共CA簽署，這意味着iOS很開心，現在的事情可以很好地工作。希望這對其他人可能會有所幫助。

來源

2016-12-05 23:31:30

我在你的舊情況下，似乎我唯一要測試的是證書是由公共CA簽署的，我希望它能正常工作 – encastellano

它應該，我概述的解決方案現在一直在爲我們工作。 –

客戶端證書和NSURLSession

回答

相關問題