- (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust
                  forDomain:(NSString *)domain
{
    //當(dāng)使用自建證書驗(yàn)證域名時(shí)，需要使用AFSSLPinningModePublicKey或者AFSSLPinningModeCertificate
    if (domain && self.allowInvalidCertificates && self.validatesDomainName && (self.SSLPinningMode == AFSSLPinningModeNone || [self.pinnedCertificates count] == 0)) {
        // https://developer.apple.com/library/mac/documentation/NetworkingInternet/Conceptual/NetworkingTopics/Articles/OverridingSSLChainValidationCorrectly.html
        //  According to the docs, you should only trust your provided certs for evaluation.
        //  Pinned certificates are added to the trust. Without pinned certificates,
        //  there is nothing to evaluate against.
        //
        //  From Apple Docs:
        //          "Do not implicitly trust self-signed certificates as anchors (kSecTrustOptionImplicitAnchors).
        //           Instead, add your own (self-signed) CA certificate to the list of trusted anchors."
        NSLog(@"In order to validate a domain name for self signed certificates, you MUST use pinning.");
        return NO;
    }

    //需要驗(yàn)證域名時(shí)今魔，需要添加一個(gè)驗(yàn)證域名的策略
    NSMutableArray *policies = [NSMutableArray array];
    if (self.validatesDomainName) {
        [policies addObject:(__bridge_transfer id)SecPolicyCreateSSL(true, (__bridge CFStringRef)domain)];
    } else {
        [policies addObject:(__bridge_transfer id)SecPolicyCreateBasicX509()];
    }

    //設(shè)置驗(yàn)證的策略跃洛，可以是多個(gè)
    SecTrustSetPolicies(serverTrust, (__bridge CFArrayRef)policies);

    if (self.SSLPinningMode == AFSSLPinningModeNone) {
        return self.allowInvalidCertificates || AFServerTrustIsValid(serverTrust);
    } else if (!AFServerTrustIsValid(serverTrust) && !self.allowInvalidCertificates) {
        return NO;
    }

    //獲取服務(wù)器證書的內(nèi)容
    switch (self.SSLPinningMode) {
        case AFSSLPinningModeNone:
        default:
            return NO;
        case AFSSLPinningModeCertificate: {
            //AFSSLPinningModeCertificate是直接將本地的證書設(shè)置為信任的根證書，然后來進(jìn)行判斷降狠，并且比較本地證書的內(nèi)容和服務(wù)器證書內(nèi)容是否相同西篓，如果有一個(gè)相同則返回YES
            NSMutableArray *pinnedCertificates = [NSMutableArray array];
            for (NSData *certificateData in self.pinnedCertificates) {
                [pinnedCertificates addObject:(__bridge_transfer id)SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certificateData)];
            }
            //設(shè)置本地的證書為服務(wù)器的根證書
            SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)pinnedCertificates);

            //通過本地的證書來判斷服務(wù)器證書是否可信锣光，不可信，則驗(yàn)證不通過
            if (!AFServerTrustIsValid(serverTrust)) {
                return NO;
            }

            // obtain the chain after being validated, which *should* contain the pinned certificate in the last position (if it's the Root CA)
            NSArray *serverCertificates = AFCertificateTrustChainForServerTrust(serverTrust);
            //客戶端是否完全包含服務(wù)端證書
            for (NSData *trustChainCertificate in [serverCertificates reverseObjectEnumerator]) {
                if ([self.pinnedCertificates containsObject:trustChainCertificate]) {
                    return YES;
                }
            }
            
            return NO;
        }
        case AFSSLPinningModePublicKey: {
            //AFSSLPinningModePublicKey是通過比較證書當(dāng)中公鑰(PublicKey)部分來進(jìn)行驗(yàn)證蔬浙，通過SecTrustCopyPublicKey方法獲取本地證書和服務(wù)器證書猪落，然后進(jìn)行比較，如果有一個(gè)相同畴博，則通過驗(yàn)證
            NSUInteger trustedPublicKeyCount = 0;
            //服務(wù)端證書
            NSArray *publicKeys = AFPublicKeyTrustChainForServerTrust(serverTrust);

            //判斷服務(wù)器證書的公鑰與本地的證書公鑰是否相同许布，相同則客戶端認(rèn)證通過
            for (id trustChainPublicKey in publicKeys) {
                //遍歷客戶端證書
                for (id pinnedPublicKey in self.pinnedPublicKeys) {
                    //對(duì)比兩者的證書是否相同
                    if (AFSecKeyIsEqualToKey((__bridge SecKeyRef)trustChainPublicKey, (__bridge SecKeyRef)pinnedPublicKey)) {
                        trustedPublicKeyCount += 1;
                    }
                }
            }
            return trustedPublicKeyCount > 0;
        }
    }
    
    return NO;
}