Swift - 使用SwiftHTTP通过HTTPS进行网络请求，及证书的使用

来源：互联网发布：淘宝联盟机器人发单编辑：程序博客网时间：2024/06/06 02:53

（本文代码已升级至Swift3）

一，证书的生成，以及服务器配置

参考我前面写的这篇文章：Tomcat服务器配置https双向认证（使用keytool生成证书）

文章详细介绍了HTTPS，SSL/TLS。还有使用key tool生成自签名证书，Tomcat下https服务的配置。

二，SwiftHTTP使用HTTPS进行网络请求

1，证书导入

前面文章介绍了通过客户端浏览器访问HTTPS服务需，需要安装“mykey.p12”，“tomcat.cer”这两个证书。同样，我们开发的应用中也需要把这两个证书添加进来。

原文:Swift - 使用SwiftHTTP通过HTTPS进行网络请求，及证书的使用

记的同时在 “工程” -> “Build Phases” -> “Copy Bundle Resources” 中添加这两个证书文件。

2，配置Info.plist

由于我们使用的是自签名的证书，而苹果ATS（App Transport Security）只信任知名CA颁发的证书，所以在iOS9下即使是HTTPS请求还是会被ATS拦截。

所以在Info.plist下添加如下配置（iOS8不需要）：

1
2
3
4
5
<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/>
</dict>

3，使用两个证书进行双向验证，以及网络请求

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
import UIKit
import SwiftHTTP
 
class ViewController: UIViewController{
     
    overridefuncviewDidLoad() {
        super.viewDidLoad()
         
        do {
            letopt = tryHTTP.GET("https://192.168.1.112:8443")
             
            opt.auth = { challengein
                 
                //认证服务器证书
                ifchallenge.protectionSpace.authenticationMethod
                    ==NSURLAuthenticationMethodServerTrust{
                    print("服务端证书认证！")
                     
                    letserverTrust:SecTrust= challenge.protectionSpace.serverTrust!
                    letcertificate =SecTrustGetCertificateAtIndex(serverTrust, 0)!
                    letremoteCertificateData
                        =CFBridgingRetain(SecCertificateCopyData(certificate))!
                    letcerPath =Bundle.main.path(forResource:"tomcat", ofType:"cer")!
                    letcerUrl =URL(fileURLWithPath:cerPath)
                    letlocalCertificateData = try!Data(contentsOf: cerUrl)
                     
                    if(remoteCertificateData.isEqual(localCertificateData)
                        ==true) {
                        letcredential =URLCredential(trust: serverTrust)
                        challenge.sender?.use(credential,for: challenge)
                        returnURLCredential(trust: challenge.protectionSpace.serverTrust!)
                    }else{
                        returnnil
                    }
                }
                //认证客户端证书
                elseifchallenge.protectionSpace.authenticationMethod
                    ==NSURLAuthenticationMethodClientCertificate
                {
                    print("客户端证书认证！")
                    //获取客户端证书相关信息
                    letidentityAndTrust:IdentityAndTrust=self.extractIdentity();
                     
                    leturlCredential:URLCredential=URLCredential(
                        identity: identityAndTrust.identityRef,
                        certificates: identityAndTrust.certArrayas? [AnyObject],
                        persistence:URLCredential.Persistence.forSession)
                     
                    returnurlCredential
                }
                // 其它情况（不接受认证）
                else{
                    print("其它情况（不接受认证）")
                    returnnil
                }
            }
             
            opt.start { responsein
                print("访问成功，获取数据如下：")
                print(response.text)
            }
        } catchleterror {
            print("请求失败:  \(error)")
        }
    }
     
    //获取客户端证书相关信息
    funcextractIdentity() ->IdentityAndTrust{
        varidentityAndTrust:IdentityAndTrust!
        varsecurityError:OSStatus= errSecSuccess
         
        letpath:String = Bundle.main.path(forResource:"mykey", ofType:"p12")!
        letPKCS12Data= NSData(contentsOfFile:path)!
        letkey :NSString= kSecImportExportPassphraseasNSString
        letoptions :NSDictionary= [key :"123456"]//客户端证书密码
        //create variable for holding security information
        //var privateKeyRef: SecKeyRef? = nil
         
        varitems :CFArray?
         
        securityError =SecPKCS12Import(PKCS12Data, options, &items)
         
        ifsecurityError == errSecSuccess {
            letcertItems:CFArray= itemsas CFArray!;
            letcertItemsArray:Array= certItemsasArray
            letdict:AnyObject? = certItemsArray.first;
            ifletcertEntry:Dictionary= dictas?Dictionary<String,AnyObject> {
                // grab the identity
                letidentityPointer:AnyObject? = certEntry["identity"]
                letsecIdentityRef:SecIdentity= identityPointeras!SecIdentity!
                print("\(identityPointer)  :::: \(secIdentityRef)")
                // grab the trust
                lettrustPointer:AnyObject? = certEntry["trust"]
                lettrustRef:SecTrust= trustPointeras!SecTrust
                print("\(trustPointer)  :::: \(trustRef)")
                // grab the cert
                letchainPointer:AnyObject? = certEntry["chain"]
                identityAndTrust =IdentityAndTrust(identityRef: secIdentityRef,
                                        trust: trustRef, certArray:  chainPointer!)
            }
        }
        returnidentityAndTrust;
    }
     
    overridefuncdidReceiveMemoryWarning() {
        super.didReceiveMemoryWarning()
    }
}
 
//定义一个结构体，存储认证相关信息
structIdentityAndTrust{
    varidentityRef:SecIdentity
    vartrust:SecTrust
    varcertArray:AnyObject
}

控制台打印输出如下：

4，只使用一个客户端证书
由于我们使用的是自签名的证书，那么对服务器的认证全由客户端这边判断。也就是说其实使用一个客户端证书“mykey.p12”也是可以的（项目中也只需导入一个证书）。
当对服务器进行验证的时候，判断服务主机地址是否正确，是的话信任即可（代码高亮部分）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
import UIKit
import SwiftHTTP
 
class ViewController: UIViewController{
     
    //自签名网站地址
    letselfSignedHosts = ["192.168.1.112","www.hangge.com"]
     
    overridefuncviewDidLoad() {
        super.viewDidLoad()
         
        do {
            letopt = tryHTTP.GET("https://192.168.1.112:8443")
             
            opt.auth = { challengein
                 
                //认证服务器（这里不使用服务器证书认证，只需地址是我们定义的几个地址即可信任）
                ifchallenge.protectionSpace.authenticationMethod
                    ==NSURLAuthenticationMethodServerTrust
                    &&self.selfSignedHosts.contains(challenge.protectionSpace.host) {
                    print("服务器认证！")
                    letcredential =URLCredential(trust: challenge.protectionSpace.serverTrust!)
                    returncredential
                }
                //认证客户端证书
                elseifchallenge.protectionSpace.authenticationMethod
                    ==NSURLAuthenticationMethodClientCertificate
                {
                    print("客户端证书认证！")
                    //获取客户端证书相关信息
                    letidentityAndTrust:IdentityAndTrust=self.extractIdentity();
                     
                    leturlCredential:URLCredential=URLCredential(
                        identity: identityAndTrust.identityRef,
                        certificates: identityAndTrust.certArrayas? [AnyObject],
                        persistence:URLCredential.Persistence.forSession)
                     
                    returnurlCredential
                }
                // 其它情况（不接受认证）
                else{
                    print("其它情况（不接受认证）")
                    returnnil
                }
            }
             
            opt.start { responsein
                print("访问成功，获取数据如下：")
                print(response.text)
            }
        } catchleterror {
            print("请求失败:  \(error)")
        }
    }
     
    //获取客户端证书相关信息
    funcextractIdentity() ->IdentityAndTrust{
        varidentityAndTrust:IdentityAndTrust!
        varsecurityError:OSStatus= errSecSuccess
         
        letpath:String = Bundle.main.path(forResource:"mykey", ofType:"p12")!
        letPKCS12Data= NSData(contentsOfFile:path)!
        letkey :NSString= kSecImportExportPassphraseasNSString
        letoptions :NSDictionary= [key :"123456"]//客户端证书密码
        //create variable for holding security information
        //var privateKeyRef: SecKeyRef? = nil
         
        varitems :CFArray?
         
        securityError =SecPKCS12Import(PKCS12Data, options, &items)
         
        ifsecurityError == errSecSuccess {
            letcertItems:CFArray= itemsas CFArray!;
            letcertItemsArray:Array= certItemsasArray
            letdict:AnyObject? = certItemsArray.first;
            ifletcertEntry:Dictionary= dictas?Dictionary<String,AnyObject> {
                // grab the identity
                letidentityPointer:AnyObject? = certEntry["identity"]
                letsecIdentityRef:SecIdentity= identityPointeras!SecIdentity!
                print("\(identityPointer)  :::: \(secIdentityRef)")
                // grab the trust
                lettrustPointer:AnyObject? = certEntry["trust"]
                lettrustRef:SecTrust= trustPointeras!SecTrust
                print("\(trustPointer)  :::: \(trustRef)")
                // grab the cert
                letchainPointer:AnyObject? = certEntry["chain"]
                identityAndTrust =IdentityAndTrust(identityRef: secIdentityRef,
                                        trust: trustRef, certArray:  chainPointer!)
            }
        }
        returnidentityAndTrust;
    }
     
    overridefuncdidReceiveMemoryWarning() {
        super.didReceiveMemoryWarning()
    }
}
 
//定义一个结构体，存储认证相关信息
structIdentityAndTrust{
    varidentityRef:SecIdentity
    vartrust:SecTrust
    varcertArray:AnyObject
}

0 0