客户证书和NSURLSession

好的，我是SSL证书和身份validation的广泛奇迹的新手，所以我可能在这里做了非常明显错误的事情。 但我正在尝试设置NSURLSession以从通过SSL网关代理的服务器下载文件。 由于我们正在构建解决方案的原因，我们希望使用非标准CA来签署证书。 因此，我有一个CACert，服务器证书和一个服务器私钥。 这些已经被加载到pkcs12文件中，我加载该文件以从文件中获取标识，然后我尝试使用该证书进行安全信任评估。

我得到的是，如果我连接到使用公共签名证书的服务器，那么服务器信任身份validation工作正常，我得到了我期待的回调。 所以我知道我已经正确完成了委托连接。

但是，对于代码中指示的测试URL上的客户端证书质询，我收到了-9802错误。 这表明证书正在被正确评估，或者我有其他错误。 实际上，服务器试图转移到ServerTrust然后卷起所有东西。 （但奇怪的是，不会调用didBecomeInvalidWithError回调，当一切出错时我都期待这种回调。）

我已打开CFNetworking诊断程序，设备日志最终看起来像这样： –

Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:2] 15:38:38.524 { AddCookies Continue: request GET https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001 HTTP/1.1 HTTPProtocol: Task: 14dcc7c0 } [3:2] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:3] 15:38:38.526 { Protocol Enqueue: request GET https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001 HTTP/1.1 Request:  {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} Message: GET https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001 HTTP/1.1 Sending: dict [4] { Accept-Encoding: gzip, deflate Accept-Language: en-us Accept: */ } } [3:3] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:4] 15:38:38.533 { SocketStream IO Logging } [3:4] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:5] 15:38:38.544 { TCP Connection Created conn: 0x14f53d10 for name 103.20.137.69, port 444 } [3:5] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:6] 15:38:38.548 { TCP Connection Start conn: 0x14f53d10 } [3:6] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:7] 15:38:38.610 { SocketStream TCP Connection Complete conn: 0x14f53d10 fd: 7 error: 0 } [3:7] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:8] 15:38:38.613 { { fd: 7, local 10.47.29.209:53929 => peer 103.20.137.69:444 } RAW-SENT 201 RAW-SENT (7) | > data [ 201 ] bytes { RAW-SENT (7) | > 00000000: 1603 0300 c401 0000 c003 0358 1168 ae99 ...........Xh. RAW-SENT (7) | > 00000010: 94f9 5ed2 d848 bb05 c846 5654 71c9 e3c9 ..^..H...FVTq... RAW-SENT (7) | > 00000020: cd65 210b a324 dacc 75e2 a900 0018 00ff .e!..$..u....... RAW-SENT (7) | > 00000030: c02c c02b c024 c00a c023 c009 c030 c02f .,.+.$.-.#...0./ RAW-SENT (7) | > 00000040: c028 c027 c013 0100 007f 0000 0012 0010 .(.'............ RAW-SENT (7) | > 00000050: 0000 0d31 3033 2e32 302e 3133 372e 3639 ..-103.20.137.69 RAW-SENT (7) | > 00000060: 000a 0008 0006 0017 0018 0019 000b 0002 .-.............. RAW-SENT (7) | > 00000070: 0100 000d 000e 000c 0501 0401 0201 0503 ...-............ RAW-SENT (7) | > 00000080: 0403 0203 3374 0000 0010 0030 002e 0268 ....3t.....0...h RAW-SENT (7) | > 00000090: 3205 6832 2d31 3605 6832 2d31 3505 6832 2.h2-16.h2-15.h2 RAW-SENT (7) | > 000000a0: 2d31 3408 7370 6479 2f33 2e31 0673 7064 -14.spdy/3.1.spd RAW-SENT (7) | > 000000b0: 792f 3308 6874 7470 2f31 2e31 0005 0005 y/3.http/1.1.... RAW-SENT (7) | > 000000c0: 0100 0000 0000 1200 00 ......... RAW-SENT (7) | > } } [3:8] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:9] 15:38:38.617 { ioLogger logStruct: array [4] { BEGIN SSL RECORD DECODE: SENT decodeHandshake [0] @ 0x14f5d915, version 303, length 196 (0xc4) ClientHello (1, 0x1), length 192 (0xc0) END SSL RECORD DECODE: SENT } } [3:9] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:10] 15:38:38.718 { { fd: 7, local 10.47.29.209:53929 => peer 103.20.137.69:444 } RAW-READ 1368 RAW-READ (7) | < data [ 1368 ] bytes { RAW-READ (7) | < 00000000: 1603 0305 a002 0000 4d03 0358 1168 b65d ........M..Xh] RAW-READ (7) | < 00000010: 4b61 2b40 e5f7 65d5 bbea a3d1 ce5d 113f Ka+@..e......].? RAW-READ (7) | < 00000020: 86be 2d04 9288 fd34 2a86 d620 5811 68b6 ..-....4*.. Xh RAW-READ (7) | < 00000030: 51f5 0beb 192f 0954 9556 c1f8 6d18 1f4b Q..../.TV.m..K RAW-READ (7) | < 00000040: 5304 638c a110 b2f6 09ab cff2 c030 0000 Sc.........0.. RAW-READ (7) | < 00000050: 05ff 0100 0100 0b00 042b 0004 2800 0242 .........+..(..B RAW-READ (7) | 0..........! RAW-READ (7) | < 00000070: 92e4 4931 8b9b ad30 0d06 092a 8648 86f7 ..I1...0-..*.H.. RAW-READ (7) | < 00000080: 0d01 0105 0500 3025 3123 3021 0603 5504 -.....0%1#0!..U. RAW-READ (7) | < 00000090: 030c 1a66 692d 706f 696e 7379 732d 7372 ...fi-poinsys-sr RAW-READ (7) | < 000000a0: 762d 7465 7374 2d30 3031 2d63 6130 2017 v-test-001-ca0 . RAW-READ (7) | < 000000b0: 0d30 3830 3332 3631 3335 3035 305a 180f -080326135050Z.. RAW-READ (7) | < 000000c0: 3230 3538 3033 3236 3133 3530 3530 5a30 20580326135050Z0 RAW-READ (7) | < 000000d0: 2d31 2b30 2906 0355 0403 0c22 6669 2d70 -1+0)..U..."fi-p RAW-READ (7) | < 000000e0: 6f69 6e73 7973 2d73 7276 2d74 6573 7467 oinsys-srv-testg RAW-READ (7) | < 000000f0: 7731 2d30 3031 2d67 656e 6572 616c 3081 w1-001-general0. RAW-READ (7) | < 00000100: 9f30 0d06 092a 8648 86f7 0d01 0101 0500 .0-..*.H..-..... RAW-READ (7) | < 00000110: 0381 8d00 3081 8902 8181 00b4 1d0e 5f53 ....0........._S RAW-READ (7) | g RAW-READ (7) | < 00000130: 628c 2514 0036 e770 ca16 15ed 73da 5997 b.%..6.p....sY RAW-READ (7) | < 00000140: 2c10 5c5f ce84 4225 5857 20a5 04af 2879 ,.\_..B%XW ...(y RAW-READ (7) | < 00000150: 661a b7c5 a9db b05c dd47 a996 63ed 58e6 f......\.G..cX RAW-READ (7) | < 00000160: 4d7a 34f4 e4b7 26fb 87c8 a08b 48e9 b504 Mz4...&.....H... RAW-READ (7) | < 00000170: 4e01 9aa9 aea4 fb02 93b6 0816 0a9b 1054 N...........-..T RAW-READ (7) | < 00000180: 6d7b 2647 dd66 ade5 e0f4 79f1 3b01 7bbf m{&G.f....y.;.{. RAW-READ (7) | < 00000190: 044a 6954 6be1 408a ce75 8302 0301 0001 .JiTk.@..u...... RAW-READ (7) | < 000001a0: a36d 306b 3009 0603 551d 1304 0230 0030 .m0k0...U....0.0 RAW-READ (7) | < 000001b0: 5e06 0355 1d1f 0457 3055 3053 a051 a04f ^..U...W0U0S.QO RAW-READ (7) | < 000001c0: 864d 6874 7470 733a 2f2f 706f 696e 7473 .Mhttps://points RAW-READ (7) | < 000001d0: 736c 7465 7374 3a38 3434 332f 6b6d 732f sltest:8443/kms/ RAW-READ (7) | < 000001e0: 6372 6c2f 6765 7463 726c 2e68 746d 6c3f crl/getcrl.html? RAW-READ (7) | < 000001f0: 6e61 6d65 3d66 692d 706f 696e 7379 732d name=fi-poinsys- RAW-READ (7) | < 00000200: 7372 762d 7465 7374 2d30 3031 2d63 6130 srv-test-001-ca0 RAW-READ (7) | < 00000210: 0d06 092a 8648 86f7 0d01 0105 0500 0381 -..*.H..-....... RAW-READ (7) | < 00000220: 8100 13f7 5f61 4699 d11c 1199 87d6 964a ...._aF........J RAW-READ (7) | < 00000230: 7e37 4454 94e6 3f8c 063f c560 68f3 4f89 ~7DT..?..?.`hO RAW-READ (7) | < 00000240: 9f53 1521 5cf3 aa47 f57c 007a e54b 1b47 .S.!\..G.|.zKG RAW-READ (7) | < 00000250: 8c98 eaaa 235b 3fcf 819a 3df9 5540 a67b ....#[?...=.U@.{ RAW-READ (7) | < 00000260: 02f1 013a c2c7 a523 a679 438f 58b3 af01 ...:...#.yC.X... RAW-READ (7) | < 00000270: 8a9e f3fb de96 ac7e 2d38 4216 a794 502e .......~-8B...P. RAW-READ (7) | < 00000280: 1b7d 9ad5 cf3b 1ebe 745e c976 bb03 90f0 .}...;..t^.v.... RAW-READ (7) | < 00000290: f8a7 4b81 5319 197f 221d 0d5f 504b c69a ..KS..".-_PK.. RAW-READ (7) | < 000002a0: 10aa 0001 e030 8201 dc30 8201 45a0 0302 .....0...0..E... RAW-READ (7) | < 000002b0: 0102 0208 6c89 815a 8bf7 15f5 300d 0609 ....l..Z....0-.. RAW-READ (7) | < 000002c0: 2a86 4886 f70d 0101 0505 0030 2531 2330 *.H..-.....0%1#0 RAW-READ (7) | < 000002d0: 2106 0355 0403 0c1a 6669 2d70 6f69 6e73 !..U....fi-poins RAW-READ (7) | < 000002e0: 7973 2d73 7276 2d74 6573 742d 3030 312d ys-srv-test-001- RAW-READ (7) | < 000002f0: 6361 3020 170d 3038 3033 3236 3133 3530 ca0 .-0803261350 RAW-READ (7) | < 00000300: 3530 5a18 0f32 3035 3830 3332 3631 3335 50Z..20580326135 RAW-READ (7) | < 00000310: 3035 305a 3025 3123 3021 0603 5504 030c 050Z0%1#0!..U... RAW-READ (7) | < 00000320: 1a66 692d 706f 696e 7379 732d 7372 762d .fi-poinsys-srv- RAW-READ (7) | < 00000330: 7465 7374 2d30 3031 2d63 6130 819f 300d test-001-ca0..0- RAW-READ (7) | < 00000340: 0609 2a86 4886 f70d 0101 0105 0003 818d ..*.H..-........ RAW-READ (7) | < 00000350: 0030 8189 0281 8100 859a a533 e990 210b .0.........3..!. RAW-READ (7) | < 00000360: 58c1 8b58 984a fd75 337c c021 d374 02d8 X..XJu3|.!.t.. RAW-READ (7) | ........#R. RAW-READ (7) | < 00000380: ac59 a650 e4ad 9d1f 02e6 97db c914 a01b .YP........... RAW-READ (7) | < 00000390: cd30 4945 8d71 5178 44f8 b4d4 9cba 2b8a .0IE.qQxD.....+. RAW-READ (7) | < 000003a0: 9077 1d85 9547 9c49 a043 7879 6899 2048 .w...GICxyh. H RAW-READ (7) | < 000003b0: 6fa5 d537 0010 0591 9d61 e854 5613 3d1d o..7.....a.TV.=. RAW-READ (7) | < 000003c0: 4677 5f8a ddb8 8d4d a885 3984 1cd9 7550 Fw_....M..9...uP RAW-READ (7) | < 000003d0: 96f4 acef 2a9f 7633 0203 0100 01a3 1330 ....*.v3.......0 RAW-READ (7) | < 000003e0: 1130 0f06 0355 1d13 0408 3006 0101 ff02 .0...U....0..... RAW-READ (7) | < 000003f0: 0101 300d 0609 2a86 4886 f70d 0101 0505 ..0-..*.H..-.... RAW-READ (7) | < 00000400: 0003 8181 007b a0cd 116b a28f b536 67bf .....{...k...6g. RAW-READ (7) | < 00000410: f87e 7b61 7543 411a 6047 7ca9 e54a 1a36 .~{auCA.`G|..J.6 RAW-READ (7) | < 00000420: e688 cd15 e346 e519 3f46 f900 79a8 e027 .....F..?F..y..' RAW-READ (7) | < 00000430: 43f9 b963 a0f6 81d0 26c5 f66d 9d88 017d C..c....&..m...} RAW-READ (7) | < 00000440: 7c99 3168 2cf4 dced 64f8 5624 81d2 6dd2 |.1h,...dV$..m. RAW-READ (7) | < 00000450: aaf4 0a0f c21d e196 e557 196c 0686 d698 ..-......Wl... RAW-READ (7) | < 00000460: 5f6a 2d12 996c 3157 0ba7 ee35 498c db3a _j-..l1W...5I..: RAW-READ (7) | < 00000470: 2835 34cb b6e5 b941 7fac bf9f cfaa 5b98 (54....A......[. RAW-READ (7) | < 00000480: d118 ca76 360c 0000 c903 0017 4104 bf45 ...v6.......A..E RAW-READ (7) | < 00000490: 344f 7916 08d2 fa31 ec81 ac4e 7baf bfe1 4Oy....1...N{... RAW-READ (7) | < 000004a0: e04e 459d 2043 f3f9 8208 fce6 35ef bc99 .NE. C......5... RAW-READ (7) | < 000004b0: b606 a4f7 19eb 3c16 7131 ade6 4952 1dc5 ......<.q1..IR.. RAW-READ (7) | < 000004c0: 3b21 3cde ab1d c06f 870e 6580 9489 0501 ;!<....o..e..... RAW-READ (7) | < 000004d0: 0080 9468 d320 2901 bcb4 07b9 691c c9b2 ...h. ).....i... RAW-READ (7) | < 000004e0: feae 734a dbb5 a658 a03f 93cb c769 2588 ..sJ...X.?...i%. RAW-READ (7) | < 000004f0: 5e5d 011c 89bb dc6e 7d72 054e b173 c8f5 ^].....n}rNs. RAW-READ (7) | < 00000500: 90c1 c0db d0ee a59d c69e 8a0f 0195 3d7b ..............={ RAW-READ (7) | < 00000510: c4f1 b067 5cb8 131c a79d ad43 0bc9 1cbd ...g\......C.... RAW-READ (7) | < 00000520: c8f0 4f57 9fbb 4680 3afa 182f af23 bea9 ..OW..F.:../.#.. RAW-READ (7) | < 00000530: 03dd c86d eb5a fae3 c449 a0b2 688e 4b0a ...mZ..I..hK- RAW-READ (7) | < 00000540: 2188 f37b a27e 5fa2 4221 d52c a98b 7e90 !..{.~_.B!.,..~. RAW-READ (7) | < 00000550: 5d81 0d00 004b 0301 ].-..K.. RAW-READ (7) | < } } [3:10] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:11] 15:38:38.730 { { fd: 7, local 10.47.29.209:53929 => peer 103.20.137.69:444 } RAW-READ 77 RAW-READ (7) | < data [ 77 ] bytes { RAW-READ (7) | < 00000000: 0240 0016 0603 0601 0503 0501 0403 0401 .@.............. RAW-READ (7) | < 00000010: 0303 0301 0203 0201 0202 002d 002b 3029 ...........-.+0) RAW-READ (7) | < 00000020: 3127 3025 0603 5504 030c 1e66 692d 706f 1'0%..U....fi-po RAW-READ (7) | < 00000030: 696e 7379 732d 7465 7374 636c 742d 636d insys-testclt-cm RAW-READ (7) | < 00000040: 7331 2d30 3031 2d63 610e 0000 00 s1-001-ca.... RAW-READ (7) | < } } [3:11] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:12] 15:38:38.732 { ioLogger logStruct: array [12] { BEGIN SSL RECORD DECODE: READ decodeHandshake [0] @ 0x15c62025, version 303, length 1440 (0x5a0) ServerHello (2, 0x2), length 77 (0x4d) decodeHandshake [1] @ 0x15c62076, version 303, length 1440 (0x5a0) Certificate (11, 0xb), length 1067 (0x42b) decodeHandshake [2] @ 0x15c624a5, version 303, length 1440 (0x5a0) ServerKeyExchange (12, 0xc), length 201 (0xc9) decodeHandshake [3] @ 0x15c62572, version 303, length 1440 (0x5a0) CertificateRequest (13, 0xd), length 75 (0x4b) decodeHandshake [4] @ 0x15c625c1, version 303, length 1440 (0x5a0) ServerHelloDone (14, 0xe), length 0 (0x0) END SSL RECORD DECODE: READ } } [3:12] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:13] 15:38:38.739 { Client Cert Requested Distinguished Names: 1 0: << DATA {length = 43, capacity = 43, bytes = 0x30293127302506035504030c1e66692d ... 312d3030312d6361} >> } [3:13] Oct 27 15:38:38 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:14] 15:38:38.742 { Authentication Challenge Loader:  {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} Challenge: challenge space https://103.20.137.69:444/, ClientCertificateRequested (Hash c3626e29) } [3:14] Oct 27 15:38:38 Philip-Banks-ipod Unknown[791] : Oct 27 15:38:43 Philip-Banks-ipod MPEtestApplication[793] : SecTrustEvaluate [leaf AnchorTrusted] Oct 27 15:38:44 Philip-Banks-ipod MPEtestApplication[793] : Certificates found: 1 Oct 27 15:38:44 Philip-Banks-ipod MPEtestApplication[793] : SecTrustEvaluate [leaf AnchorTrusted] Oct 27 15:38:44 Philip-Banks-ipod MPEtestApplication[793] : User: (null), certificates ( "" ) identity: Oct 27 15:38:46 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:15] 15:38:46.070 { Use Credential Loader:  {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} Credential: Name: 400-133-738-MOB, Persistence: permanent } [3:15] Oct 27 15:38:46 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:16] 15:38:46.074 { touchConnection Loader:  {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} Timeout Interval: 60.000 seconds } [3:16] Oct 27 15:38:46 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:17] 15:38:46.078 { Peer certificate Subject Sum: fi-poinsys-srv-testgw1-001-general Summary: fi-poinsys-srv-test-001-ca } [3:17] Oct 27 15:38:46 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:18] 15:38:46.093 { Authentication Challenge Loader:  {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} Challenge: challenge space https://103.20.137.69:444/, ServerTrustEvaluationRequested (Hash c3626e29) } [3:18] Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:19] 15:38:47.250 { Use Credential Loader:  {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} Credential: null } [3:19] Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:20] 15:38:47.252 { touchConnection Loader:  {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} Timeout Interval: 60.000 seconds } [3:20] Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] : SecTrustEvaluate [leaf SSLHostname] [root AnchorTrusted] Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] : NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802) Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:21] 15:38:47.255 { Response Error Request:  {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} Error: Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFNetworkCFStreamSSLErrorOriginalValue=-9802, _kCFStreamPropertySSLClientCertificateState=2, _kCFStreamErrorCodeKey=-9802, kCFStreamPropertySSLPeerTrust=, _kCFStreamErrorDomainKey=3, kCFStreamPropertySSLPeerCertificates={type = immutable, count = 2, values = ( 0 :  1 :  )}, _kCFStreamPropertySSLClientCertificates={type = mutable-small, count = 2, values = ( 0 :  1 :  )}} } [3:21] Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:22] 15:38:47.258 { Did Fail Loader:  {url = https://103.20.137.69:444/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001, cs = 0x0} Error: Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFNetworkCFStreamSSLErrorOriginalValue=-9802, _kCFStreamPropertySSLClientCertificateState=2, _kCFStreamErrorCodeKey=-9802, kCFStreamPropertySSLPeerTrust=, _kCFStreamErrorDomainKey=3, kCFStreamPropertySSLPeerCertificates={type = immutable, count = 2, values = ( 0 :  1 :  )}, _kCFStreamPropertySSLClientCertificates={type = mutable-small, count = 2, values = ( 0 :  1 :  )}} init to origin load: 0.011323s total time: 8.75724s total bytes: 0 } [3:22] Oct 27 15:38:47 Philip-Banks-ipod MPEtestApplication[793] : CFNetwork Diagnostics [3:23] 15:38:47.275 { ~HTTPProtocol: nullptr request Request: null sent: 0 received: 0 cell sent: 0 cell received: 0 } [3:23] 

这似乎很清楚，认证失败了，但不是为什么它失败了。 我很感激这里有任何有用的建议，因为我有点困在这一点上。

正在使用针对10 SDK的XCode 8构建并将其部署到iOS 9.3.5设备上构建此代码。

以下是有问题的代码： –

 #import "testSSLClass.h" @interface testSSLClass() { NSString* mDownloadURL; NSURLSessionConfiguration* mDownloadConfiguration; NSURLSession* mDownloadSession; NSURLSessionDataTask* mDownloadTask; NSMutableData* mDataReceived; } @end @implementation testSSLClass -(instancetype)init { if (self = [super init]) { mDownloadURL = @"https://103.20.137.69:443/downloadfile.aspx?filename=MON___00DADDF5FFFF00&tspid=100581332001"; mDownloadConfiguration = [NSURLSessionConfiguration ephemeralSessionConfiguration]; } return self; } -(void)doADownload { mDataReceived = [NSMutableData new]; NSURL* URLtoFetch = [NSURL URLWithString:mDownloadURL]; mDownloadSession = [NSURLSession sessionWithConfiguration:mDownloadConfiguration delegate:self delegateQueue:nil]; mDownloadTask = [mDownloadSession dataTaskWithURL:URLtoFetch]; [mDownloadTask resume]; } -(void)URLSession:(NSURLSession *)session didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential * _Nullable))completionHandler { if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) { [self willSendRequestForAuthenticationChallenge:challenge completionHandler:completionHandler]; } else { completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil); } } -(void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didReceiveData:(NSData *)data { [mDataReceived appendData:data]; } -(void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask willCacheResponse:(NSCachedURLResponse *)proposedResponse completionHandler:(void (^)(NSCachedURLResponse * _Nullable))completionHandler { [mDataReceived length]; } -(void)URLSession:(NSURLSession *)session didBecomeInvalidWithError:(NSError *)error { NSLog(@"Error: %@", [error userInfo]); } -(void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didBecomeStreamTask:(NSURLSessionStreamTask *)streamTask { NSLog(@"Did Become Stream Task"); } - (void)willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential * _Nullable))completionHandler { if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) { NSArray* paths = NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES); NSString* directoryPath = [paths objectAtIndex:0]; NSString* cacertPath = [directoryPath stringByAppendingPathComponent:@"client.p12"]; NSData *p12data = [NSData dataWithContentsOfFile:cacertPath]; CFDataRef inP12data = (__bridge CFDataRef)p12data; SecIdentityRef myIdentity; SecTrustRef myTrust; extractIdentityAndTrust(inP12data, &myIdentity, &myTrust); assert(myIdentity != nil); assert(myTrust != nil); long count = SecTrustGetCertificateCount(myTrust); NSMutableArray* myCertificates = nil; if(count > 0) { myCertificates = [NSMutableArray arrayWithCapacity:count]; for(int i = 0; i < count; ++i) { [myCertificates addObject:(__bridge id)SecTrustGetCertificateAtIndex(myTrust, i)]; } } SecTrustResultType trustResult; OSStatus evalResult = SecTrustEvaluate(myTrust, &trustResult); if (trustResult == kSecTrustResultRecoverableTrustFailure) { CFDataRef errDataRef = SecTrustCopyExceptions(myTrust); SecTrustSetExceptions(myTrust, errDataRef); evalResult = SecTrustEvaluate(myTrust, &trustResult); } NSURLCredential *credential = [NSURLCredential credentialWithIdentity:myIdentity certificates:myCertificates persistence:NSURLCredentialPersistencePermanent]; assert(credential != nil); NSLog(@"User: %@, certificates %@ identity:%@", [credential user], [credential certificates], [credential identity]); [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge]; completionHandler(NSURLSessionAuthChallengeUseCredential,credential); } else { completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil); } } OSStatus extractIdentityAndTrust(CFDataRef inP12data, SecIdentityRef *identity, SecTrustRef *trust) { OSStatus securityError = errSecSuccess; CFStringRef password = CFSTR("password"); const void *keys[] = { kSecImportExportPassphrase }; const void *values[] = { password }; CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL); CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL); securityError = SecPKCS12Import(inP12data, options, &items); if (securityError == 0) { CFDictionaryRef myIdentityAndTrust = CFArrayGetValueAtIndex(items, 0); const void *tempIdentity = NULL; tempIdentity = CFDictionaryGetValue(myIdentityAndTrust, kSecImportItemIdentity); *identity = (SecIdentityRef)tempIdentity; const void *tempTrust = NULL; tempTrust = CFDictionaryGetValue(myIdentityAndTrust, kSecImportItemTrust); *trust = (SecTrustRef)tempTrust; CFIndex count = CFArrayGetCount(items); NSLog(@"Certificates found: %ld",count); } if (options) { CFRelease(options); } return securityError; } @end 

任何建议，提示或建议感激不尽。

菲利普