IOS項目最近剛配置好這個https，總結一下大概流程和方法。

配置Https：

(一)準備證書

.cer (后端提供，有可能是crt，直接改后綴為cer就行)

.p12 (后端給過來的pfx證書,里面包含公鑰私鑰，把證書導入鑰匙串，然后導出為.p12文件,帶密碼)

(二)檢查證書

1.檢查是否符合，把證書拉入項目根目錄，點擊就可以查看相關信息

Paste_Image.png

2.打開終端輸入 nscurl —ats-diagnostics —verbose https://你的域名/

然后會出現類似這樣的反饋，分別有TLSv1.0----TLSv1.2的測試案例返回，
如果HTTPS服務器能通過ATS特性，則上面所有測試案例都是PASS；如果某一項的Reuslt是FAIL，就找到ATS Dictionary來查看，就能知道HTTPS服務器不滿足ATS哪個條件。

Paste_Image.png

3.然后根據測試案例TLSv1.2返回的NSExceptionDomains信息配置項目的根.plist文件的App Transport Security Settings->Exception Domains->

【圖僅供示例，請根據自己的返回填寫】

Paste_Image.png

(三)代碼設置,雙向認證

{     //manager自行配置
      AFHTTPSessionManager *manager = nil;
        
      if ([self baseUrl] != nil) {
        manager = [[AFHTTPSessionManager alloc] initWithBaseURL:[NSURL URLWithString:[self baseUrl]]];
      } else {
        manager = [AFHTTPSessionManager manager];
      }
      manager.securityPolicy = [self getSecurityPolicy];

      [manager setSessionDidBecomeInvalidBlock:^(NSURLSession * _Nonnull session, NSError * _Nonnull error) {
            NSLog(@"setSessionDidBecomeInvalidBlock");
        }];
        //客服端請求驗證 重寫 setSessionDidReceiveAuthenticationChallengeBlock 方法
        __weak typeof(self)weakSelf = self;
       [manager setSessionDidReceiveAuthenticationChallengeBlock:^NSURLSessionAuthChallengeDisposition(NSURLSession*session, NSURLAuthenticationChallenge *challenge, NSURLCredential *__autoreleasing*_credential) {
            NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengePerformDefaultHandling;
            __autoreleasing NSURLCredential *credential =nil;
            if([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
                if([weakSelf.manager.securityPolicy evaluateServerTrust:challenge.protectionSpace.serverTrust forDomain:challenge.protectionSpace.host]) {
                    credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust];
                    if(credential) {
                        disposition =NSURLSessionAuthChallengeUseCredential;
                    } else {
                        disposition =NSURLSessionAuthChallengePerformDefaultHandling;
                    }
                } else {
                    disposition = NSURLSessionAuthChallengeCancelAuthenticationChallenge;
                }
            } else {
                // client authentication
                SecIdentityRef identity = NULL;
                SecTrustRef trust = NULL;
               //后端給過來的pfx證書導入鑰匙串，然后導出為.p12文件,名字隨意。示例為：client.p12
                NSString *p12 = [[NSBundle mainBundle] pathForResource:@"client" ofType:@"p12"];
                NSFileManager *fileManager =[NSFileManager defaultManager];
                
                if(![fileManager fileExistsAtPath:p12])
                {
                    NSLog(@"client.p12:not exist");
                }
                else
                {
                    NSData *PKCS12Data = [NSData dataWithContentsOfFile:p12];
                    
                    if ([[weakSelf class] extractIdentity:&identity andTrust:&trust fromPKCS12Data:PKCS12Data])
                    {
                        SecCertificateRef certificate = NULL;
                        SecIdentityCopyCertificate(identity, &certificate);
                        const void*certs[] = {certificate};
                        CFArrayRef certArray =CFArrayCreate(kCFAllocatorDefault, certs,1,NULL);
                        credential =[NSURLCredential credentialWithIdentity:identity certificates:(__bridge  NSArray*)certArray persistence:NSURLCredentialPersistencePermanent];
                        disposition =NSURLSessionAuthChallengeUseCredential;
                    }
                }
            }
            *_credential = credential;
            return disposition;
        }];
}

+(BOOL)extractIdentity:(SecIdentityRef*)outIdentity andTrust:(SecTrustRef *)outTrust fromPKCS12Data:(NSData *)inPKCS12Data {
    OSStatus securityError = errSecSuccess;
    //client certificate password
    NSDictionary*optionsDictionary = [NSDictionary dictionaryWithObject:@"p12證書密碼"
                                                                 forKey:(__bridge id)kSecImportExportPassphrase];
    
    CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
    securityError = SecPKCS12Import((__bridge CFDataRef)inPKCS12Data,(__bridge CFDictionaryRef)optionsDictionary,&items);
    
    if(securityError == 0) {
        CFDictionaryRef myIdentityAndTrust =CFArrayGetValueAtIndex(items,0);
        const void*tempIdentity =NULL;
        tempIdentity= CFDictionaryGetValue (myIdentityAndTrust,kSecImportItemIdentity);
        *outIdentity = (SecIdentityRef)tempIdentity;
        const void*tempTrust =NULL;
        tempTrust = CFDictionaryGetValue(myIdentityAndTrust,kSecImportItemTrust);
        *outTrust = (SecTrustRef)tempTrust;
    } else {
        NSLog(@"Failedwith error code %d",(int)securityError);
        return NO;
    }
    return YES;
}

+ (AFSecurityPolicy*)getSecurityPolicy{
    NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"cer證書名字" ofType:@"cer"];
    NSData *certData = [NSData dataWithContentsOfFile:cerPath];
    NSSet *certSet = [NSSet setWithObject:certData];
    AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
    policy.allowInvalidCertificates = YES;
    policy.validatesDomainName = NO;
    policy.pinnedCertificates = certSet;
    /**** SSL Pinning ****/
    return policy;
}

OK，完成

【可能遇到的問題】
SecCertificateCreateWithData 獲取nil閃退問題