1 - (instancetype)initWithBaseURL:(NSURL *)url {

 2     self = [super initWithBaseURL:url];

 3     if (self) {

 4

 5         self.requestSerializer.timeoutInterval = 25;

 6         [self.requestSerializer setValue:@"application/json" forHTTPHeaderField:@"Accept"];

 7         [self.requestSerializer setValue:url.absoluteString forHTTPHeaderField:@"Referer"];

 8

 9         self.securityPolicy = [self getFreeCustomSecurityPolicy];

10

11         self.responseSerializer.acceptableContentTypes = [NSSet setWithObjects:@"text/plain", @"multipart/form-data", @"application/json", @"text/html", @"image/jpeg", @"image/png", @"application/octet-stream", @"text/json", nil];

12         self.requestSerializer.cachePolicy = NSURLRequestReloadIgnoringLocalCacheData;

13

14         [self setSessionDidBecomeInvalidBlock:^(NSURLSession * _Nonnull session, NSError * _Nonnull error) {

15             NSLog(@"setSessionDidBecomeInvalidBlock error : %@",error);

16         }];

17         if ([url.absoluteString hasPrefix:@"https"]) {//当请求是https时,我们就需要做

18             __weak typeof(self) weakSelf = self;

19             [self setSessionDidReceiveAuthenticationChallengeBlock:^NSURLSessionAuthChallengeDisposition(NSURLSession * _Nonnull session, NSURLAuthenticationChallenge * _Nonnull challenge, NSURLCredential *__autoreleasing  _Nullable * _Nullable credential) {

20                 NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengePerformDefaultHandling;

21                 __autoreleasing NSURLCredential * credentialSelf =nil;

22                 if([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {//如果有受信任的证书,如果是自签名的证书,这里会是NSURLAuthenticationMethodClientCertificate

23                     if([weakSelf.securityPolicy evaluateServerTrust:challenge.protectionSpace.serverTrust forDomain:challenge.protectionSpace.host]) {

24                         credentialSelf = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust];

25                         if(credentialSelf) {

26                             disposition = NSURLSessionAuthChallengeUseCredential;

27                         } else {

28                             disposition = NSURLSessionAuthChallengePerformDefaultHandling;

29                         }

30                     } else {

31                         disposition = NSURLSessionAuthChallengeCancelAuthenticationChallenge;

32                     }

33                 } else {//当接收到的是NSURLAuthenticationMethodClientCertificate,我们就将我们的证书发送给服务器让其验证我们的身份

34                     // client authentication

35                     SecIdentityRef identity = NULL;

36                     SecTrustRef trust = NULL;

37                     NSString *p12 = [[NSBundle mainBundle] pathForResource:@"client"ofType:@"p12"];

38                     NSFileManager *fileManager =[NSFileManager defaultManager];

39                     if(![fileManager fileExistsAtPath:p12])

40                     {

41                         NSLog(@"client.p12:not exist");

42                     } else {

43                         NSData *PKCS12Data = [NSData dataWithContentsOfFile:p12];

44

45                         if ([weakSelf  extractIdentity:&identity andTrust:&trust fromPKCS12Data:PKCS12Data])

46                         {

47                             SecCertificateRef certificate = NULL;

48                             SecIdentityCopyCertificate(identity, &certificate);

49                             const void*certs[] = {certificate};

50                             CFArrayRef certArray =CFArrayCreate(kCFAllocatorDefault, certs,1,NULL);

51                             credentialSelf =[NSURLCredential credentialWithIdentity:identity certificates:(__bridge  NSArray*)certArray persistence:NSURLCredentialPersistencePermanent];

52                             disposition = NSURLSessionAuthChallengeUseCredential;

53                         }

54                     }

55                 }

56                 *credential = credentialSelf;

57                 return disposition;

58             }];

59         }

60     }

61     return self;

62 }

63 - (BOOL)extractIdentity:(SecIdentityRef*)outIdentity andTrust:(SecTrustRef *)outTrust fromPKCS12Data:(NSData *)inPKCS12Data {

64     OSStatus securityError = errSecSuccess;

65     //client certificate password

66     NSDictionary*optionsDictionary = [NSDictionary dictionaryWithObject:@"password" forKey:(__bridge id)kSecImportExportPassphrase];

67     CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);

68     securityError = SecPKCS12Import((__bridge CFDataRef)inPKCS12Data,(__bridge CFDictionaryRef)optionsDictionary,&items);

69

70     if(securityError == 0) {

71         CFDictionaryRef myIdentityAndTrust =CFArrayGetValueAtIndex(items,0);

72         const void*tempIdentity =NULL;

73         tempIdentity= CFDictionaryGetValue (myIdentityAndTrust,kSecImportItemIdentity);

74         *outIdentity = (SecIdentityRef)tempIdentity;

75         const void*tempTrust =NULL;

76         tempTrust = CFDictionaryGetValue(myIdentityAndTrust,kSecImportItemTrust);

77         *outTrust = (SecTrustRef)tempTrust;

78     } else {

79         NSLog(@"Failedwith error code %d",(int)securityError);

80         return NO;

81     }

82     return YES;

83 }

84 - (AFSecurityPolicy *)getFreeCustomSecurityPolicy {

85     AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];

86     NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"server" ofType:@"cer"];

87     NSData *certData = [NSData dataWithContentsOfFile:cerPath];

88     NSSet *certificateSet  = [[NSSet alloc] initWithObjects:certData, nil];

89     [securityPolicy setAllowInvalidCertificates:YES];

90     [securityPolicy setPinnedCertificates:certificateSet];

91     [securityPolicy setValidatesDomainName:NO];

92

93     return securityPolicy;

94 }