iOS开发中适配HTTPS

从CA认证机构买证书

看AFNetworking

  - (void)setSecurityPolicy:(AFSecurityPolicy *)securityPolicy {
if (securityPolicy.SSLPinningMode != AFSSLPinningModeNone && ![self.baseURL.scheme isEqualToString:@"https"]) {
    NSString *pinningMode = @"Unknown Pinning Mode";
    switch (securityPolicy.SSLPinningMode) {
        case AFSSLPinningModeNone:        pinningMode = @"AFSSLPinningModeNone"; break;
        case AFSSLPinningModeCertificate: pinningMode = @"AFSSLPinningModeCertificate"; break;
        case AFSSLPinningModePublicKey:   pinningMode = @"AFSSLPinningModePublicKey"; break;
    }
    NSString *reason = [NSString stringWithFormat:@"A security policy configured with `%@` can only be applied on a manager with a secure base URL (i.e. https)", pinningMode];
    @throw [NSException exceptionWithName:@"Invalid Security Policy" reason:reason userInfo:nil];
}

[super setSecurityPolicy:securityPolicy];
  }

  typedef NS_ENUM(NSUInteger, AFSSLPinningMode) {
AFSSLPinningModeNone,
AFSSLPinningModePublicKey,
AFSSLPinningModeCertificate,
  };

AFSSLPinningModeNone

如果我们使用AFSSLPinningModeNone那就是不做SSL pinning，我们客户端不用做任何处理，和浏览器验证证书的方式一样。（完全信任服务器证书）

AFSSLPinningModePublicKey

只比对服务器证书和本地证书的Public Key是否一致，如果一致则信任服务器证书

AFSSLPinningModeCertificate

比对服务器证书和本地证书的所有内容，完全一致则信任服务器证书

代码设置

  AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey withPinnedCertificates:[AFSecurityPolicy certificatesInBundle:[NSBundle mainBundle]]];
    manager.securityPolicy = securityPolicy;

  -(AFSecurityPolicy*)customSecurityPolicy {
NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"server" ofType:@"cer"];
NSData *cerData = [NSData dataWithContentsOfFile:cerPath];
AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
securityPolicy.allowInvalidCertificates = YES;
securityPolicy.validatesDomainName=NO;
securityPolicy.pinnedCertificates= [NSSetsetWithArray:@[cerData]];
return securityPolicy;
  }