iOS开发中AFNetworking中如何设置https请求（使用自建证书）

由于项目原因我的通信是用的二进制流通信所以用如下代码

NSMutableURLRequest *request=[conn sendMsg:msg];

    

    AFHTTPRequestOperation *op = [[AFHTTPRequestOperation alloc] initWithRequest:request];

    op.securityPolicy.allowInvalidCertificates=YES;

    [op setCompletionBlockWithSuccess:^(AFHTTPRequestOperation *operation, id responseObject) {

        NSData *data=(NSData *)responseObject;

        msgService *service=[msgService sharedInstance];

        msgPackageRes *res=[[msgPackageRes alloc]initWithData:data];

        NSInteger msgCode=[res getMessageCode];

        Class obj=[service getResMsg:msgCode];

        myStreamRead *read=[[obj alloc]initWithData:[res getMydata]];

        handleMsg *msg=[service getHandler:msgCode with:read];

        [msg doAction];

        NSLog(@"成功%@",responseObject);

    } failure:^(AFHTTPRequestOperation *operation, NSError *error) {

        NSLog(@"失败->%@", error);

    }];

    

    

    //执行

    NSOperationQueue * queue =[[NSOperationQueue alloc] init];

    [queue addOperation:op];

其中op.securityPolicy.allowInvalidCertificates=YES;设置为yes，意味着可以使用任何证书来进行ssl验证，这是第一步。

第二步我们需要进入到op.securityPolicy的源文件中 AFSecurityPolicy.m中

修改方法

- (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust

                  forDomain:(NSString *)domain

{

    if (domain && self.allowInvalidCertificates && self.validatesDomainName && (self.SSLPinningMode == AFSSLPinningModeNone || [self.pinnedCertificates count] == 0)) {

        // https://developer.apple.com/library/mac/documentation/NetworkingInternet/Conceptual/NetworkingTopics/Articles/OverridingSSLChainValidationCorrectly.html

        //  According to the docs, you should only trust your provided certs for evaluation.

        //  Pinned certificates are added to the trust. Without pinned certificates,

        //  there is nothing to evaluate against.

        //

        //  From Apple Docs:

        //          "Do not implicitly trust self-signed certificates as anchors (kSecTrustOptionImplicitAnchors).

        //           Instead, add your own (self-signed) CA certificate to the list of trusted anchors."

        NSLog(@"In order to validate a domain name for self signed certificates, you MUST use pinning.");

        return NO;

    }

    NSMutableArray *policies = [NSMutableArray array];

    if (self.validatesDomainName) {

        [policies addObject:(__bridge_transfer id)SecPolicyCreateSSL(true, (__bridge CFStringRef)domain)];

    } else {

        [policies addObject:(__bridge_transfer id)SecPolicyCreateBasicX509()];

    }

    SecTrustSetPolicies(serverTrust, (__bridge CFArrayRef)policies);

    if (self.SSLPinningMode == AFSSLPinningModeNone) {

        return self.allowInvalidCertificates || AFServerTrustIsValid(serverTrust);

    } else if (!AFServerTrustIsValid(serverTrust) && !self.allowInvalidCertificates) {

        return NO;

    }

    NSArray *serverCertificates = AFCertificateTrustChainForServerTrust(serverTrust);

    switch (self.SSLPinningMode) {

        case AFSSLPinningModeNone:

        default:

            return NO;

        case AFSSLPinningModeCertificate: {

            NSMutableArray *pinnedCertificates = [NSMutableArray array];

            for (NSData *certificateData in self.pinnedCertificates) {

                [pinnedCertificates addObject:(__bridge_transfer id)SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certificateData)];

            }

            SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)pinnedCertificates);

            if (!AFServerTrustIsValid(serverTrust)) {

                return NO;

            }

            NSUInteger trustedCertificateCount = 0;

            for (NSData *trustChainCertificate in serverCertificates) {

                if ([self.pinnedCertificates containsObject:trustChainCertificate]) {

                    trustedCertificateCount++;

                }

            }

            return trustedCertificateCount > 0;

        }

        case AFSSLPinningModePublicKey: {

            NSUInteger trustedPublicKeyCount = 0;

            NSArray *publicKeys = AFPublicKeyTrustChainForServerTrust(serverTrust);

            for (id trustChainPublicKey in publicKeys) {

                for (id pinnedPublicKey in self.pinnedPublicKeys) {

                    if (AFSecKeyIsEqualToKey((__bridge SecKeyRef)trustChainPublicKey, (__bridge SecKeyRef)pinnedPublicKey)) {

                        trustedPublicKeyCount += 1;

                    }

                }

            }

            return trustedPublicKeyCount > 0;

        }

    }

    

    return NO;

}

把红色标注的代码注释掉，这样第一步的设置才会生效。这样就可以进行https请求了，此请求允许无效证书也就是自建证书请求。