UIWebView iOS中的客户端证书身份验证

为了避免UIWebView中出现任何问题,您必须在Web视图请求之前使用客户端证书向您的网站root发出请求.您可以使用UIWebViewDelegate方法：

-(BOOL)webView:(UIWebView *)webView shouldStartLoadWithrequest:(NSURLrequest *)request navigationType:(UIWebViewNavigationTypE)navigationType

在此之后,UIWebView将能够毫无问题地加载所有内容.

如果您是Objective-C的新手,我想您也是Foundation框架的新手,所以这里有一些帮助.

为了解决这个问题,我使用了ASI@R_489_10107@request,因为它已经嵌入到我们的项目中.但您可以使用NSURLConnection并在NSURLConnectionDelegate方法中执行逻辑：

- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChALLENge:(NSURLAuthenticationChALLENge *)chALLENge

所以,这是我的代码,在UIWebView请求之前向ASI@R_489_10107@request提供客户端证书：

-(BOOL)webView:(UIWebView *)webView shouldStartLoadWithrequest:(NSURLrequest *)request navigationType:(UIWebViewNavigationTypE)navigationType
{

  SecIdentityRef identity = NULL;
  SecTrustRef trust       = NULL;  
  NSData *PKCS12Data      = [NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForresource:@"test.cert" ofType:@"pfx"]];

  [self extractIdentity:&identity andTrust:&trust fromPKCS12Data:PKCS12Data];

  NSURL *serverUrl              = [NSURL URLWithString:URL_SECURE_SERVER];
  ASI@R_489_10107@request *firstrequest  = [ASI@R_489_10107@request requestWithURL:serverUrl];

  [firstrequest SETVALidatesSecureCertificate:NO];
  [firstrequest setClientCertificatEIDentity:identity];
  [firstrequest startSynchronous];

  return YES;
}

我正在同步发送请求,以确保在UIWebView开始加载之前完成.

我使用一种方法从证书中检索身份,即：

- (BOOL)extractIdentity:(SecIdentityRef *)outIdentity andTrust:(SecTrustRef*)outTrust fromPKCS12Data:(NSData *)inPKCS12Data
{
  OSStatus securityError          = errSecsuccess;
  NSDictionary *optionsDictionary = [NSDictionary DictionaryWithObject:@"mobigate" forKey:(id)kSecImportExportPassphrase];

  CFArrayRef items  = CFArrayCreate(NULL,null);
  securityError     = SecPKCS12Import((CFDataRef)inPKCS12Data,(CFDictionaryRef)optionsDictionary,&items);

  if (securityError == 0) { 
    CFDictionaryRef myIdentityAndTrust  = CFArrayGetValueATindex (items,0);
    const void *tempIdentity            = NULL;

    tempIdentity = CFDictionaryGetValue (myIdentityAndTrust,kSecImportItemIdentity);
    *outIdentity = (SecIdentityRef)tempIdentity;

    const void *tempTrust = NULL;

    tempTrust = CFDictionaryGetValue (myIdentityAndTrust,kSecImportItemTrust);
    *outTrust = (SecTrustRef)tempTrust;

  } 
  else {
    NSLog(@"Failed with error code %d",(int)securityError);
    return NO;
  }

  return YES;
}

这里使用相同的技术,但使用NSURLConnection而不是ASI@R_489_10107@request

>获取您的SecIdentityRef和SecCertificateRef
>使用这些信息创建NSURLCredential
>将此NSURLCredential发送回连接中的[chALLENge sender]：didReceiveAuthenticationChALLENge：method

要使用NSURLConnection证书,您必须实现NSURLConnectionDelegate方法：

- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChALLENge:(NSURLAuthenticationChALLENge *)chALLENge

在这种方法中,NSURLConnection告诉你它收到了一个挑战.您必须创建一个NSURLCredential才能发送回[质询发件人]

所以你创建了NSURLCredential：

+ (NSURLCredential *)credentialWithIdentity:(SecIdentityRef)identity certificates:(NSArray *)certArray persistence:(NSURLCredentialPersistencE)persistence
{

  NSString *certPath = [[NSBundle mainBundle] pathForresource:@"certificate" ofType:@"cer"];
  NSData *certData   = [[NSData alloc] initWithContentsOfFile:certPath];

  SecIdentityRef myIdentity;  // ???

  SecCertificateRef myCert = SecCertificateCreateWithData(NULL,(CFDataRef)certData);
  [certData release];
  SecCertificateRef certArraY[1] = { myCert };
  CFArrayRef myCerts = CFArrayCreate(NULL,(void *)certArray,1,null);
  CFRelease(myCert);
  NSURLCredential *credential = [NSURLCredential credentialWithIdentity:myIdentity
                              certificates:(NSArray *)myCerts
                               persistence:NSURLCredentialPersistencePeRMANent];
  CFRelease(myCerts);
}

最后用它

- (void)useCredential:(NSURLCredential *)credential forAuthenticationChALLENge:(NSURLAuthenticationChALLENge *)chALLENge

在[挑战发件人]

你应该拥有所需的一切.祝好运.