無法使用Apple應用證明根證書驗證X509Certificate的有效性

我所能做的就是使用其方法 checkValidity() 驗證生成的 X509Certificate，但按照https://developer.apple.com/documentation/devicecheck/validating_apps_that_connect_to_your_server中提到的步驟，我們必須使用 Apple App 驗證 X509Certificate證明根證書是

-----BEGIN CERTIFICATE-----
MIICITCCAaegAwIBAgIQC/O DvHN0uD7jG5yH2IXmDAKBggqhkjOPQQDAzBSMSYw
JAYDVQQDDB1BcHBsZSBBcHAgQXR0ZXN0YXRpb24gUm9vdCBDQTETMBEGA1UECgwK
QXBwbGUgSW5jLjETMBEGA1UECAwKQ2FsaWZvcm5pYTAeFw0yMDAzMTgxODMyNTNa
Fw00NTAzMTUwMDAwMDBaMFIxJjAkBgNVBAMMHUFwcGxlIEFwcCBBdHRlc3RhdGlv
biBSb290IENBMRMwEQYDVQQKDApBcHBsZSBJbmMuMRMwEQYDVQQIDApDYWxpZm9y
bmlhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAERTHhmLW07ATaFQIEVwTtT4dyctdh
NbJhFs/Ii2FdCgAHGbpphY3 d8qjuDngIN3WVhQUBHAoMeQ/cLiP1sOUtgjqK9au
Yen1mMEvRq9Sk3Jm5X8U62H xTD3FE9TgS41o0IwQDAPBgNVHRMBAf8EBTADAQH/
MB0GA1UdDgQWBBSskRBTM72 aEH/pwyp5frq5eWKoTAOBgNVHQ8BAf8EBAMCAQYw
CgYIKoZIzj0EAwMDaAAwZQIwQgFGnByvsiVbpTKwSga0kP0e8EeDS4 sQmTvb7vn
53O5 FRXgeLhpJ06ysC5PrOyAjEAp5U4xDgEgllF7En3VcE3iexZZtKeYnpqtijV
oyFraWVIyd/dganmrduC1bmTBGwD
-----END CERTIFICATE-----

你可以看看我的代碼：

String decodedCredCert = "
    -----BEGIN CERTIFICATE----MIIC4jCCAmmgAwIBAgIGAX66NktmMAoGCCqGSM49BAMCME8xIzAhBgNVBAMMGkFwcGxlIEFwcCBBdHRlc3RhdGlvbiBDQSAxMRMwEQYDVQQKDApBcHBsZSBJbmMuMRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTIyMDIwMTExMzM0N1oXDTIyMDIwNDExMzM0N1owgZExSTBHBgNVBAMMQGMwYTY1ZmRjYjE1MDJjNTNmNzUyMzM4NzZlM2ViZTE3NGVlMzYyODkwZDVmZGE3N2RmZTJhMmE2NWQwOTQ1MGYxGjAYBgNVBAsMEUFBQSBDZXJ0aWZpY2F0aW9uMRMwEQYDVQQKDApBcHBsZSBJbmMuMRMwEQYDVQQIDApDYWxpZm9ybmlhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExooI0SVHKxhLJu 1zDz1VmCQU7SDdoYTBP5FPsl3sn2sYc1De9tzkKCbb/txsvZXDU6cn HH5Lt3w4 s wkkmqOB7TCB6jAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIE8DB6BgkqhkiG92NkCAUEbTBrpAMCAQq/iTADAgEBv4kxAwIBAL JMgMCAQG/iTMDAgEBv4k0IgQgV0EyREI2MzdKVy5jb20uZ2wubWljaGFlbEtvcnMucWGlBgQEc2tzIL JNgMCAQW/iTcDAgEAv4k5AwIBAL JOgMCAQAwGQYJKoZIhvdjZAgHBAwwCr KeAYEBDE1LjIwMwYJKoZIhvdjZAgCBCYwJKEiBCCDM1heaSkW2MvNzjxqor1xYX1U/tdYlXz9a1CiCT/VBjAKBggqhkjOPQQDAgNnADBkAjA4Ek QKVFVunbBBBbjQ4qfni7vhXVABvbV/ru8CjsSc/fkuKsR4mKmmWjNoFq2vnACMAv5YFRC6rt1fv9vD1duDxv608DOGZtC95H7LOI65RHn0IYiq1iMLfBF 
    MPUPwJACRw==
    -----END CERTIFICATE----- ";
                        X509Certificate cert1 = getParentCertificate(decodedCredCert);
                        System.out.println(cert1);
                        cert1.checkValidity();

我在哪里

uj5u.com熱心網友回復：

此應用程式證明步驟是驗證證書鏈。您將在證明請求中獲得 2 個證書，即在 x5c[0]、x5c[1] 下。這些是葉證書和中間證書。

要驗證證書鏈，x5c[0] 證書應由 x5c[1] 簽名，x5c[1] 證書應由 Apple App attest 根證書簽名。

示例代碼

    CertificateFactory cf = CertificateFactory.getInstance(AppConstants.X_509);
    byte[] credCertByte = Base64.getDecoder().decode(x5c[0]);
    X509Certificate credCert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(credCertByte));

    byte[] caCertByte = Base64.getDecoder().decode(x5c[1]);
    X509Certificate caCert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(caCertByte));
    X509Certificate appleAppAttestationRootCaCert = (X509Certificate) cf
            .generateCertificate(APPLE_APP_ATTEST_CERT);

    credCert.verify(caCert.getPublicKey());
    caCert.verify(appleAppAttestationRootCaCert.getPublicKey());

標籤：ssl ssl 证书 x509证书 x509 设备检查

上一篇：瀏覽器cookie和更新的證書問題

下一篇：帶有wwwSSL系結錯誤的子域：嘗試為AzureWebApp添加SSL系結時沒有證書