SSL锁定快速应对身份验证挑战

Question

I am trying to implement SSL pinning and I did, using the didReceiveAuthentication Challenge. I do have a question, however, is that the description of this function

https://developer.apple.com/documentation/webkit/wknavigationdelegate/1455638-webview?language=objc

and so are the URLSession Version of it, both mentioned that only when the challenge is received. My worry is that, would there be website that doesn't ask for client certificate at all? If that is the case, how am I suppose to do SSL pinning then?

Answer 1

Client-side certificate pinning has nothing to do with client certificates. didReceiveAuthenticationChallenge: is called in response to receiving the server's certificate as well. In that case it's called with the protectionSpace.authenticationMethod set to NSURLAuthenticationMethodServerTrust . If the server requests a client certificate, it'll be called again with ...ClientCertificate . If Basic Auth is required, it'll be called again with ...HTTPBasic and so on.