Certificate pinning
ssl_pinning_plugin
Plugin for check SSL Pinning on request HTTP.
Checks the equality between the known SHA-1 or SHA-256 fingerprint and the SHA-1 or SHA-256 of the target server.
http://www.reibang.com/p/f4b09b06aad7
對于我的應(yīng)用程序询微，我添加了以下代碼，讓它只接受我的打嗝證書憎兽。SecurityContext構(gòu)造函數(shù)接受一個參數(shù)withTrustedRoots麦撵，其默認(rèn)為false。
ByteData data = await rootBundle.load('certs/burp.crt');
SecurityContext context = new SecurityContext();
context.setTrustedCertificatesBytes(data.buffer.asUint8List());
client = HttpClient(context: context);
Flutter開發(fā)人員想要執(zhí)行ssl Pinning的方法之一是通過ssl_pinning_plugin flutter插件搏屑。此插件實際上旨在發(fā)送一個HTTPS連接并驗證證書争涌，之后開發(fā)人員將信任該通道并執(zhí)行HTTPS請求：
Https certificate verification(Base on Dio plugin)
There are two ways to verify the https certificate. Suppose the certificate format is PEM, the code like:
String PEM="XXXXX"; // certificate content
(dio.httpClientAdapter as DefaultHttpClientAdapter).onHttpClientCreate = (client) {
client.badCertificateCallback=(X509Certificate cert, String host, int port){
if(cert.pem==PEM){ // Verify the certificate
return true;
}
return false;
};
};
Another way is creating a SecurityContext when create the HttpClient:
(dio.httpClientAdapter as DefaultHttpClientAdapter).onHttpClientCreate = (client) {
SecurityContext sc = new SecurityContext();
//file is the path of certificate
sc.setTrustedCertificates(file);
HttpClient httpClient = new HttpClient(context: sc);
return httpClient;
};
In this way, the format of certificate must be PEM or PKCS12.
你的證書如果是自簽名證書，那么默認(rèn)不被信任辣恋，直接請求你的服務(wù)器亮垫，就會走到此回調(diào)。如果你的證書是可信CA頒發(fā)的伟骨，并且你請求的domain包含在證書里饮潦，便會自動通過驗證，因為別人偽造不了(除非CA亂發(fā)證書)携狭，這是Dart自動執(zhí)行的驗證继蜡，如果請求的domain沒在證書里，那就說明此證書并非你的暑中，證書檢驗失敗壹瘟，此時也會進(jìn)入此回調(diào)。如果你想無論證書是否有效鳄逾，都想自己檢驗稻轨，目前Dart沒有提供這樣的回調(diào)。
Future createDio() async{
this.dio = Dio();
String cerData = await rootBundle.loadString("assets/cc.pem");
this.dio.onHttpClientCreate = (HttpClient client){
SecurityContext clientContext = SecurityContext(withTrustedRoots: true)
..useCertificateChainBytes(utf8.encode(cerData));
return HttpClient(context: clientContext);
};
this.dio.interceptor.request.onSend = (Options options){
return options;
};
}
package:http在引擎蓋下使用dart:io HttpClient雕凹，并且HttpClient有幾個允許證書驗證的功能殴俱。由于客戶機(jī)不信任自簽名服務(wù)器證書，因此客戶機(jī)將調(diào)用badCertificateCallback以允許您自己驗證服務(wù)器證書枚抵，例如
HttpClient httpClient = new HttpClient()
..badCertificateCallback =
((X509Certificate cert, String host, int port) {
// tests that cert is self signed, correct subject and correct date(s)
return (cert.issuer == cert.subject &&
cert.subject == 'MySelfSignedCertCN' &&
cert.endValidity.millisecondsSinceEpoch == 1234567890);
});
IOClient ioClient = new IOClient(httpClient);
// use ioClient to perform get/post operations from package:http
// don't forget to call ioClient.close() when done
// note, this also closes the underlying HttpClient
