为什么 Alamofire 公钥固定不起作用？

Question

I am trying to perform public key pinning using Alamofire and Moya.

I am building my own custom Alamofire Session and passing it to my Moya provider. I have read the documentation of Alamofire on how to perform public key pinning which is summarized by these few lines of code:

let configuration = URLSessionConfiguration.default
let trustManager = ServerTrustManager(evaluators: ["domain.example.com": PublicKeysTrustEvaluator()])
return MySession(configuration: configuration, serverTrustManager: trustManager)

My understanding is that PublicKeysTrustEvaluator() will filter through all certificates found in Bundle.main and extract the public keys and perform public key pinning against the host. If at least one succeeds, then the server trust is considered valid.

Here is some code from the Alamofire project:

extension AlamofireExtension where ExtendedType: Bundle {
    /// Returns all valid `cer`, `crt`, and `der` certificates in the bundle.
    public var certificates: [SecCertificate] {
        paths(forResourcesOfTypes: [".cer", ".CER", ".crt", ".CRT", ".der", ".DER"]).compactMap { path in
            guard
                let certificateData = try? Data(contentsOf: URL(fileURLWithPath: path)) as CFData,
                let certificate = SecCertificateCreateWithData(nil, certificateData) else { return nil }

            return certificate
        }
    }

    /// Returns all public keys for the valid certificates in the bundle.
    public var publicKeys: [SecKey] {
        certificates.af.publicKeys
    }

Why is Alamofire allowing the use of .cer/.crt files if the function SecCertificateCreateWithData only expects DER formats?

The function paths is returning my .cer file but Bundle.main.af.publicKeys is empty because this call SecCertificateCreateWithData always fails.

Should I convert my certificate to DER format?

If so, how should I do this?

The output of this call is not being found by the function paths(forResourcesOfTypes mentioned above.

openssl x509 -outform der -in certificatename.pem -out certificatename.der

UPDATE

I found that my certificate was incorrect. I replaced it with another of .cer format and this time, I got no errors. However, all of my API calls result in a 405 error even though this piece of code right here from the Alamofire code:

if !pinnedKeysInServerKeys {
   throw AFError.serverTrustEvaluationFailed(reason: .publicKeyPinningFailed(host: host, trust: trust, pinnedKeys: keys, serverKeys: trust.af.publicKeys))
}

returns a false. So, does that mean the server trust evaluation did not fail?

Answer 1

You can make it work by just adding your trust certification inside your app bundle. Just Make sure you add the correct certificate of your server. That's all.