如何在IOS中使用安全的受阻服务器连接XMPP客户端？

Question

我正在使用Ejabbered服务器使用SSL和TLSv1.1 / 1.2保护安全的聊天应用程序，并且正在尝试将客户端连接到服务器，并得到以下错误代码。

Error Domain=GCDAsyncSocketErrorDomain Code=7 "Socket closed by remote peer" UserInfo={NSLocalizedDescription=Socket closed by remote peer.

Appdelegate（Setupstream）中的必需设置

 _xmppStream.hostName=@"";   // hostname
 _xmppStream.hostPort=5223;  // 5223 for secure SSL connection
 _xmppStream.startTLSPolicy = XMPPStreamStartTLSPolicyRequired;
  customCertEvaluation = YES;

之后，手动信任自定义证书验证

- (void)xmppStream:(XMPPStream *)sender willSecureWithSettings:
   (NSMutableDictionary *)settings{
    NSString *expectedCertName = [_xmppStream.myJID domain];

  if (expectedCertName){
   [settings setObject:expectedCertName forKey:(NSString *)kCFStreamSSLPeerName];
  }
  if (customCertEvaluation){
   [settings setObject:@(YES)forKey:GCDAsyncSocketManuallyEvaluateTrust];
  }

之后，以匹配completedHandler中的客户端服务器证书。

  -(void)xmppStream:(XMPPStream *)sender didReceiveTrust:(SecTrustRef)trust 
      completionHandler:(void (^)(BOOL shouldTrustPeer))completionHandler{

    SecCertificateRef certificate=SecTrustGetCertificateAtIndex(trust, 0);
     NSLog(@"serverCertificate :%@",certificate);
     NSData *certData1=(__bridge NSData *)SecCertificateCopyData(certificate);

    //  Get our certificate
     NSString *cer = [NSString stringWithFormat:@"%@", [[NSBundle mainBundle] pathForResource:@"ca" ofType:@"crt"]];
     NSData *certData2 = [[NSData alloc] initWithContentsOfFile:cer];

     OSStatus status = -1;
     SecTrustResultType result = kSecTrustResultDeny;

   if(certData1 && certData2){
     SecCertificateRef   cert1;
     cert1 = SecCertificateCreateWithData(NULL, (__bridge CFDataRef) certData1);

     SecCertificateRef   cert2;
     cert2 = SecCertificateCreateWithData(NULL, (__bridge CFDataRef) certData2);

     const void *ref[] = {cert1, cert2};
     CFArrayRef ary = CFArrayCreate(NULL, ref, 2, NULL);

     SecTrustSetAnchorCertificates(trust, ary);
     status = SecTrustEvaluate(trust, &result);
    }
  else{
       NSLog(@"local certificates could not be loaded");
       completionHandler(NO);
      }

 if ((status == noErr && (result == kSecTrustResultProceed || result == kSecTrustResultUnspecified))){
      completionHandler(YES);
      NSLog(@"Certificate match");
    }
 else{
     arrayRefTrust = SecTrustCopyProperties(trust);
     NSLog(@"error in connection occured\n%@", arrayRefTrust);
     completionHandler(NO);
     NSLog(@"Certificate not match");
     }
  }

GCDAsyncSocket.m / XMPPStream.m类中是否有任何自定义项需要安全连接。

Answer 1

尝试使用此不推荐使用的方法：

[self.xmppStream oldSchoolSecureConnectWithTimeout:60.f error:&connectionError]

还要确保您正确设置了主机名：

[self.xmppStream setHostName:@"yourhostname.com"]不使用https作为前缀。

目前，我们正在使用这种解决方法，同时找到了一种无需使用不推荐使用的连接方法的工作方法。