如何验证我的证书是否已成功添加到设备钥匙串

Question

我正在尝试将证书导入设备钥匙串，我正在获取我的 API。我已使用这些参考文献以证书格式保存收到的数据。参考文献：（SecPKCS12Import 在 iOS 11 上返回的结果与 iOS 10 上不同） 和在 Swift 中将证书添加到 IOS 钥匙串 通过进行一些修改以将证书添加到钥匙串，我完成了以下代码：

 ` func certificateFromCertificate(certP12: Data, psswd: String) {
        let decodedData =  certP12
        
        let keytmp : NSString = kSecImportExportPassphrase as NSString
        let options : NSDictionary = [keytmp : psswd]
        
        var certificateRef: SecCertificate? = nil
        
        var items : CFArray?
        
        let securityError: OSStatus = SecPKCS12Import(decodedData as CFData, options, &items)
        
        let theArray: CFArray = items!
        if securityError == noErr && CFArrayGetCount(theArray) > 0 {
            let newArray = theArray as [AnyObject] as NSArray
            let dictionary = newArray.object(at: 0)
            let secIdentity = (dictionary as AnyObject)[kSecImportItemIdentity as String] as! SecIdentity
            let securityError = SecIdentityCopyCertificate(secIdentity , &certificateRef)
            if securityError != noErr {
                certificateRef = nil
            }
        }
        
                var keychainQueryDictionary = [String : Any]()

                if let tempSecCert = certificateRef {
                    keychainQueryDictionary = [kSecClass as String : kSecClassCertificate, kSecValueRef as String : tempSecCert, kSecAttrLabel as String: "My Certificate"]
                }

                let summary =  SecCertificateCopySubjectSummary(certificateRef!)!  as String
                print("Cert summary: \(summary)")

                let status = SecItemAdd(keychainQueryDictionary as CFDictionary, nil)

            print(SecCopyErrorMessageString(status, nil))

    }`

我得到了正确的证书摘要以及这个

print(SecCopyErrorMessageString(status, nil))

没有返回错误。

Optional(No error.)

我的疑问是该证书是否正确安装在设备钥匙串中。我如何验证这一点？请注意，我不想强制信任该证书。

我试过了

var keychainQueryDictionary = [String : Any]()
    
if let tempSecCert = certificateRef {
  keychainQueryDictionary = [kSecClass as String : kSecClassCertificate, kSecValueRef as String : tempSecCert, kSecAttrLabel as String: "My Certificate"]
}
    
let summary =  SecCertificateCopySubjectSummary(certificateRef!)!  as String
print("Cert summary: \(summary)")
    
let status = SecItemAdd(keychainQueryDictionary as CFDictionary, nil)

这会将证书导入到设备的钥匙串中。我想验证是否安装成功。

Answer 1

您的导入代码正确。

iOS 没有提供在 UI 上查看这些导入的证书的方法，您必须通过 Security API 查询它们，此代码循环遍历所有证书并按其过滤证书

X509 Common Name

:

func queryCertificate(with commonName: String) -> Bool{
  let query: [String: Any] = [
    kSecClass as String: kSecClassCertificate,
    kSecReturnRef as String: true,
    kSecMatchLimit as String: kSecMatchLimitAll
  ]
  
  
  var items: CFTypeRef?
  let status = SecItemCopyMatching(query as CFDictionary, &items)
  
  if status == errSecSuccess {
    if let certificates = items as? [SecCertificate] {
      for certificate in certificates {
        var commonName: CFString?
        if SecCertificateCopyCommonName(certificate, &commonName) == errSecSuccess, let cn = commonName {
          if cn == commonName {
            debugPrint("Found Cert:\(certificate)")
            return true
          }
        }
      }
    }
  }
  
  print("Certificate not found")
  return false
}

您可以使用 openssl 获取通用名称，或者导入 macOS 后在 KeyChain App 中查看。

Answer 2

当然可以通过openssh解压.pem文件来查看p12的有效期。