- (void)webView:(WKWebView *)webView didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *_Nullable credential))completionHandler

當(dāng)中去實(shí)現(xiàn)H5的雙向認(rèn)證邏輯

實(shí)踐

編碼

根據(jù)整個(gè)業(yè)務(wù)流程哲身，我們把編碼實(shí)現(xiàn)過程大致分為以下幾步：

1. App啟動(dòng)時(shí)候，通過PKI供應(yīng)商的HTTPS通道贸伐，進(jìn)行證書的申請(qǐng)和校驗(yàn)勘天，并將證書保存在App中，并且完成ATS的設(shè)置捉邢；
2. 從證書當(dāng)中導(dǎo)出雙向認(rèn)證需要的自簽名的根證書脯丝，以及該移動(dòng)設(shè)備關(guān)聯(lián)的客戶端證書數(shù)據(jù)；
3. 在App當(dāng)中接口請(qǐng)求的時(shí)候伏伐，通過根證書宠进，以及客戶端證書數(shù)據(jù)完成雙向認(rèn)證；
4. 在App當(dāng)中完成加載H5頁面時(shí)藐翎，攔截并重構(gòu)請(qǐng)求砰苍，完成網(wǎng)頁及網(wǎng)頁請(qǐng)求接口的雙向認(rèn)證潦匈，通過代理實(shí)現(xiàn)雙向認(rèn)證；
5. 優(yōu)化App應(yīng)用證書的啟動(dòng)過程赚导，以及證書管理的安全等；

證書的申請(qǐng)赤惊，因?yàn)椴捎玫谌降腟DK實(shí)現(xiàn)的吼旧，編碼工作較為簡(jiǎn)單，簡(jiǎn)單調(diào)用SDK的API實(shí)現(xiàn)即可未舟，本質(zhì)上是一個(gè)文件下載的過程圈暗，下載下來的證書數(shù)據(jù)格式為 .pfx / .p12，保存在App的沙河目錄下裕膀，有口令可以對(duì)P12文件數(shù)據(jù)進(jìn)行導(dǎo)出導(dǎo)入,而ATS設(shè)置中员串，需要對(duì)于公司HTTPS域名進(jìn)行例外處理，而ATS不開啟會(huì)觸發(fā)額外的審核昼扛，上架時(shí)候需要說明ATS設(shè)置的緣由

<key>NSAppTransportSecurity</key>
    <dict>
        <key>NSAllowsArbitraryLoadsInWebContent</key>
        <true/>
        <key>NSAllowsArbitraryLoads</key>
        <false/>
        <key>NSExceptionDomains</key>
        <dict>
            <key>xxxx.com</key>
            <dict>
                <key>NSExceptionAllowsInsecureHTTPLoads</key>
                <true/>
                <key>NSIncludesSubdomains</key>
                <true/>
            </dict>
        </dict>
    </dict>

從證書當(dāng)中導(dǎo)出所需數(shù)據(jù)

    NSData *PKCS12Data = [NSData dataWithContentsOfFile:localFilePath];
    self.pkcs12FileData = PKCS12Data;
    if (PKCS12Data) {
        SecTrustRef trust = NULL;
        if ([self extractServerTrustData:&trust fromPKCS12Data:PKCS12Data]) {
            CFIndex certCount;
            certCount = SecTrustGetCertificateCount(trust);
            if (certCount >= 1) {
                SecCertificateRef certificate = SecTrustGetCertificateAtIndex(trust, certCount - 1);
                NSData *data = (__bridge_transfer NSData *)SecCertificateCopyData(certificate);
                self.serverRootCerData = data;
            }
        }
    }

// extractServerTrustData當(dāng)中實(shí)現(xiàn)數(shù)據(jù)的獲取
NSDictionary *optionsDictionary = [NSDictionary dictionaryWithObject:authCode
                                                                  forKey:(__bridge id)kSecImportExportPassphrase];
    CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
   securityError = SecPKCS12Import((__bridge CFDataRef)inPKCS12Data, (__bridge CFDictionaryRef)optionsDictionary, &items);
    if (securityError == 0) {
        CFDictionaryRef trustDataDict = CFArrayGetValueAtIndex(items, 0);
        const void *tempTrust = NULL;
        tempTrust = CFDictionaryGetValue(trustDataDict, kSecImportItemTrust);
        *outTrust = (SecTrustRef)tempTrust;
        *outIdentity = (SecIdentityRef)CFDictionaryGetValue(trustDataDict, kSecImportItemIdentity);//客戶端證書憑證數(shù)據(jù)
        *certArr = (CFArrayRef)CFDictionaryGetValue(certDataDict, kSecImportItemCertChain);
    }

接口進(jìn)行雙向認(rèn)證

// 如果是NSURLSession請(qǐng)求寸齐，代理中進(jìn)行處理, AFN請(qǐng)求中，調(diào)用 [manager setSessionDidReceiveAuthenticationChallengeBlock:]

- (void)URLSession:(NSURLSession *)session didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential *_Nullable))completionHandler {

NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengePerformDefaultHandling;
    NSURLCredential *customCredential = nil;
     // 對(duì)服務(wù)端證書進(jìn)行認(rèn)證
    if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
        OSStatus err;
        SecTrustRef trust = [[challenge protectionSpace] serverTrust];
        if (trust == NULL) {
            return;
        }
        // 設(shè)置錨點(diǎn)證書
        NSMutableArray *policies = [NSMutableArray array];
        [policies addObject:(__bridge_transfer id)SecPolicyCreateBasicX509()];
        SecTrustSetPolicies(trust, (__bridge CFArrayRef)policies);

        NSMutableArray *pinnedCertificates = [NSMutableArray array];
        // 證書的數(shù)據(jù)是之前獲取的根證書數(shù)據(jù)
        [pinnedCertificates addObject:(__bridge_transfer id)SecCertificateCreateWithData(NULL, (__bridge CFDataRef)serverRootCerData)];
        err = SecTrustSetAnchorCertificates(trust, (__bridge CFArrayRef)pinnedCertificates);
        if (err == noErr) {
            err = SecTrustSetAnchorCertificatesOnly(trust, false);
        }
        CFErrorRef error = NULL;
        if (@available(iOS 12.0, *)) {
            __unused bool r = SecTrustEvaluateWithError(trust, &error);
            if (error == noErr) {
                customCredential = [NSURLCredential credentialForTrust:trust];
            } 
        } else {
            SecTrustResultType trustResult = kSecTrustResultInvalid;
            err = SecTrustEvaluate(trust, &trustResult); //kSecTrustResultRecoverableTrustFailure
            if (err == noErr) {
                if ((trustResult == kSecTrustResultProceed) || (trustResult == kSecTrustResultUnspecified)) {
                    customCredential = [NSURLCredential credentialForTrust:trust];
                }
            }
        }
    } else {
        // 服務(wù)端接收客戶端證書認(rèn)證
        SecIdentityRef identity = NULL;
        CFArrayRef certArray = NULL;
        if ([self extractIdentity:&identity fromPKCS12Data:pkcs12FileData certArray:&certArray]) {
            // identity 系統(tǒng)使用的證書數(shù)據(jù)身份抄谐，客戶端證書對(duì)應(yīng)的數(shù)據(jù)
            // certificates 建議傳nil渺鹦，除非服務(wù)端需要傳遞 intermediate certifate，一般服務(wù)端內(nèi)置了中間證書
            // NSURLCredentialPersistenceForSession  對(duì)于網(wǎng)絡(luò)雙向認(rèn)證蛹含，只用填寫這個(gè)值就可以
            if (identity) {
                customCredential = [NSURLCredential credentialWithIdentity:identity certificates:(__bridge NSArray *)certArray persistence:NSURLCredentialPersistenceForSession];
            }
            disposition = NSURLSessionAuthChallengeUseCredential;
        }
    }

    if (completionHandler) {
        completionHandler(disposition, customCredential);
    }
 }

App WKWebView加載 H5

1. 首先需要通過NSURLProtocol 對(duì)webView請(qǐng)求攔截重構(gòu)毅厚，實(shí)現(xiàn)雙向認(rèn)證的處理

    // 避免私有API審核被拒 
 Class cls = [[[WKWebView new] valueForKey:@"browsingContextController"] class];
   SEL sel = NSSelectorFromString(@"registerSchemeForCustomProtocol:");
 
    if (cls && [cls respondsToSelector:sel]) {
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Warc-performSelector-leaks"
        // 只需要匹配https的scheme, 這里不攔截http協(xié)議的請(qǐng)求
        [cls performSelector:sel withObject:@"https"];
#pragma clang diagnostic pop
    }
    // 注冊(cè)網(wǎng)絡(luò)請(qǐng)求協(xié)議代理類到URL Loading System
    [NSURLProtocol registerClass:LLURLProtocol.class];

在 LLURLProtocol的類中，我們把webView的請(qǐng)求進(jìn)行了HOOK浦箱，然后通過 NSURLSession 構(gòu)造了新的請(qǐng)求吸耿。LLURLProtocol是繼承自NSURLProtocol， NSURLProtocol需要實(shí)現(xiàn)幾個(gè)協(xié)議方法酷窥，可以 理解 NSURLProtocol：

+ (BOOL)canInitWithRequest:(NSURLRequest *)request;
+ (NSURLRequest *)canonicalRequestForRequest:(NSURLRequest *)request;
- (void)startLoading;
- (void)stopLoading;

于是我做了如下的實(shí)現(xiàn)：

+ (BOOL)canInitWithRequest:(NSURLRequest *)request {
    if (![request.URL.scheme isEqualToString:@"https"]) {
        return NO;
    }
    if ([NSURLProtocol propertyForKey:HTTPHandledIdentifier inRequest:request]) {
        return NO;
    }
    // 對(duì)于指定的host咽安，允許hook，則返回YES竖幔，否則NO
    return result;
}

// 插入防止重復(fù)請(qǐng)求的標(biāo)志
+ (NSURLRequest *)canonicalRequestForRequest:(NSURLRequest *)request {
    NSMutableURLRequest *mutableReqeust = [request mutableCopy];
    [NSURLProtocol setProperty:@YES
                        forKey:HTTPHandledIdentifier
                     inRequest:mutableReqeust];
    return mutableReqeust;
}

// 啟動(dòng)請(qǐng)求
- (void)startLoading {
    self.startDate = [NSDate date];
    self.data = [NSMutableData data];
    NSURLSessionConfiguration *configuration = [NSURLSessionConfiguration defaultSessionConfiguration];
    self.session = [NSURLSession sessionWithConfiguration:configuration delegate:self delegateQueue:nil];
    self.dataTask = [self.session dataTaskWithRequest:self.request];
    [self.dataTask resume];
}
// 請(qǐng)求結(jié)束
 - (void)stopLoading {
    [self.dataTask cancel];
    self.dataTask = nil;
}

- (void)URLSession:(NSURLSession *)session didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential *_Nullable))completionHandler {
    NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengePerformDefaultHandling;
    NSURLCredential *customCredential = nil;
    if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
        }
     // 里面的實(shí)現(xiàn)方式和第3步的是一樣的板乙。
 }

至此，我們便完成對(duì)于WebView加載自簽名的HTTPS的H5加載了拳氢。

以上第一種實(shí)現(xiàn)方式有bug募逞，采用第二種webView代理的方式直接實(shí)現(xiàn)：

// 處理webView雙向認(rèn)證的信任邏輯
- (void)webView:(WKWebView *)webView didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *_Nullable credential))completionHandler {
    // 只對(duì)API的域名進(jìn)行雙向認(rèn)證處理，其他web頁不處理
    NSString *authHost = challenge.protectionSpace.host;
    if (![authHost containsString:@"xxx.com"]) {
        NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengePerformDefaultHandling;
        NSURLCredential *customCredential = nil;
        if (completionHandler) {
            completionHandler(disposition, customCredential);
        }
        return;
    }

    NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengeUseCredential;
    NSURLCredential *customCredential = nil;
    if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
        // 服務(wù)端認(rèn)證
        OSStatus err;
        SecTrustRef trust = [[challenge protectionSpace] serverTrust];
        // 設(shè)置錨點(diǎn)證書
        NSMutableArray *policies = [NSMutableArray array];
        [policies addObject:(__bridge_transfer id)SecPolicyCreateBasicX509()];
        SecTrustSetPolicies(trust, (__bridge CFArrayRef)policies);
        NSMutableArray *pinnedCertificates = [NSMutableArray array];
        [pinnedCertificates addObject:(__bridge_transfer id)SecCertificateCreateWithData(NULL, (__bridge CFDataRef)serverRootCerData)];
        [pinnedCertificates addObject:(__bridge_transfer id)SecCertificateCreateWithData(NULL, (__bridge CFDataRef)serverIntermediateCerData)];

        err = SecTrustSetAnchorCertificates(trust, (__bridge CFArrayRef)pinnedCertificates);
        if (err == noErr) {
            err = SecTrustSetAnchorCertificatesOnly(trust, false);
        }
        if (err != noErr) {
            NSLog(@"\nset anchor certificates failed!, pinnedCertificates: %@ \n", pinnedCertificates);
        }
        CFErrorRef error = NULL;
        if (@available(iOS 12.0, *)) {
            __unused bool r = SecTrustEvaluateWithError(trust, &error);
            if (error == noErr) {
                customCredential = [NSURLCredential credentialForTrust:trust];
            } else {
                NSLog(@"\nverify server certificates failed!, pinnedCertificates: %@ \n", pinnedCertificates);
            }

        } else {
            SecTrustResultType trustResult = kSecTrustResultInvalid;
            err = SecTrustEvaluate(trust, &trustResult); //kSecTrustResultRecoverableTrustFailure
            if (err == noErr) {
                if ((trustResult == kSecTrustResultProceed) || (trustResult == kSecTrustResultUnspecified)) {
                    customCredential = [NSURLCredential credentialForTrust:trust];
                }
            }
        }
    } else {
        // 客戶端發(fā)送證書認(rèn)證
        SecIdentityRef identity = NULL;
        CFArrayRef certArray = NULL;
        // 從PKCS12文件數(shù)據(jù)導(dǎo)出identity
        if ([self extractIdentity:&identity fromPKCS12Data:pkcs12FileData certArray:&certArray]) {
            // identity 系統(tǒng)使用的證書數(shù)據(jù)身份馋评，客戶端證書對(duì)應(yīng)的數(shù)據(jù)
            // certificates 建議傳nil放接，除非服務(wù)端需要傳遞 intermediate certifate，一般服務(wù)端內(nèi)置了中間證書
            // NSURLCredentialPersistenceForSession  對(duì)于網(wǎng)絡(luò)雙向認(rèn)證留特，只用填寫這個(gè)值就可以
            if (identity) {
                customCredential = [NSURLCredential credentialWithIdentity:identity certificates:(__bridge NSArray *)certArray persistence:NSURLCredentialPersistenceForSession];
            }
            disposition = NSURLSessionAuthChallengeUseCredential;
        }
    }

    if (completionHandler) {
        completionHandler(disposition, customCredential);
    }
}

調(diào)試

當(dāng)需要對(duì)網(wǎng)絡(luò)數(shù)據(jù)包進(jìn)行分析纠脾，需要和IT人員一起查找并確定網(wǎng)關(guān)玛瘸，或者服務(wù)端代理，配置等問題時(shí)苟蹈，需要有好的工具才可以讓我們事半功倍糊渊。 而在mac上，Apple官方也給出了建議的參考工具慧脱，如 Taking Advantage of Third-Party Network Debugging Tools 所說渺绒，包括其他很多IT人員也會(huì)用，選擇 WireShark 這款應(yīng)用菱鸥。

Wireshark is a free and open source packet analyzer that supports macOS.

至于該如何使用宗兼，我們可以參照網(wǎng)絡(luò)的使用說明，簡(jiǎn)單看一下怎么抓包使用：
打開wireShark應(yīng)用氮采，然后我們連接的網(wǎng)絡(luò)是有線USB 還是無線Wi-Fi殷绍，選擇后就可以進(jìn)入抓包界面。


一般情況下鹊漠，我們需要過濾我們關(guān)心的端口主到，或者協(xié)議，支持篩選：

687E4D5A-E8EA-4734-8DE2-E08746A8F77E.png

抓包完成停止后贸呢，就可以 在File - > Export specified Packets 镰烧，當(dāng)中導(dǎo)出當(dāng)前的抓包數(shù)據(jù)， 好了楞陷，接下來把抓包數(shù)據(jù)給IT人員一起分析怔鳖，查找問題吧！

總結(jié)

1. PKI和HTTPS雙向認(rèn)證固蛾， 第一步首先得將需要的服務(wù)端證書结执，以及客戶端證書數(shù)據(jù)打包到App當(dāng)中，至于證書的獲取形式是預(yù)先打包艾凯，還是通過可靠的下載渠道進(jìn)行下載献幔，就跟業(yè)務(wù)的規(guī)劃有關(guān)了；

2. 要完成HTTPS雙向認(rèn)證趾诗，需要分別對(duì)于接口的請(qǐng)求蜡感，NSURLSession的代理進(jìn)行證書數(shù)據(jù)的校驗(yàn)，也需要對(duì)于WKWebView加載的H5做HOOK恃泪，然后轉(zhuǎn)到代理去完成證書的認(rèn)證郑兴；

3. 調(diào)試中利用好一些工具比如WireShark，從抓包數(shù)據(jù)可以直接看到SSL握手過程贝乎，以及證書數(shù)據(jù)的傳輸?shù)惹榱膫€(gè)環(huán)節(jié)出現(xiàn)了問題，更有效地排查解決掉問題览效。

4. 還有個(gè)問題需要繼續(xù)測(cè)試并觀察：

   iOS - NSProtocol 攔截 WKWebView POST 請(qǐng)求 body 會(huì)被清空的問題解決

   【騰訊Bugly干貨分享】WKWebView 那些坑

   可以棄用攔截WKWebView的方式却舀，在WKWebview的代理當(dāng)中完成授權(quán)認(rèn)證虫几，可以避免這種問題出現(xiàn)

最后：文中的很多內(nèi)容都是自己摸索和不斷理解得到的，如有理解偏差的挽拔，歡迎指正交流辆脸！

參考

iOS 中對(duì) HTTPS 證書鏈的驗(yàn)證
HTTPS雙向認(rèn)證研究
證書的信任鏈校驗(yàn)：certificate trust chain
iOS使用NSURLProtocol來Hook攔截WKWebview請(qǐng)求并回放的一種姿勢(shì)
Overriding TLS Chain Validation Correctly
Creating Certificates for TLS Testing
HTTPS Server Trust Evaluation
Taking Advantage of Third-Party Network Debugging Tools
iOS 12、macOS 10.14篱昔、watchOS 5 和 tvOS 12 中可用的受信任根證書列表