国密SM2证书移动端适配：Android/iOS客户端双向认证实战

import org.bouncycastle.jce.provider.BouncyCastleProvider;
import javax.net.ssl.*;
import java.security.Security;
import java.security.KeyStore;
import java.io.InputStream;

public class GmTLSClient {
    
    static {
        // 注册BouncyCastleprovider（必须在TLS握手前）
        Security.addProvider(new BouncyCastleProvider());
    }
    
    public static SSLSocketFactory createGmSSLSocketFactory(
            Context context, 
            String p12Path, 
            String password) throws Exception {
        
        // 1. 加载客户端证书和私钥
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        InputStream is = new FileInputStream(p12Path);
        keyStore.load(is, password.toCharArray());
        is.close();
        
        // 2. 初始化KeyManager
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(
            "X509", "BC");
        kmf.init(keyStore, password.toCharArray());
        
        // 3. 初始化TrustManager（信任国密CA根证书）
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(
            "PKIX", "BC");
        tmf.init(loadTrustStore(context));
        
        // 4. 创建SSLContext，指定国密密码套件
        SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
        sslContext.init(
            kmf.getKeyManagers(),
            tmf.getTrustManagers(),
            new SecureRandom()
        );
        
        return sslContext.getSocketFactory();
    }
    
    private static KeyStore loadTrustStore(Context context) throws Exception {
        KeyStore trustStore = KeyStore.getInstance("PKCS12");
        InputStream caStream = 
            context.getResources().openRawResource(R.raw.ca_chain);
        trustStore.load(caStream, "ca_password".toCharArray());
        return trustStore;
    }
}

OkHttpClient client = new OkHttpClient.Builder()
    .sslSocketFactory(
        GmTLSClient.createGmSSLSocketFactory(context, p12Path, password),
        createX509TrustManager()
    )
    .hostnameVerifier((hostname, session) -> {
        // 国密证书通常使用IP或通用名称，不进行严格的DNS匹配
        return true;
    })
    .build();

Request request = new Request.Builder()
    .url("https://gmsm-server.example.com/api/data")
    .build();

client.newCall(request).execute();

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <false/>
    <key>NSExceptionDomains</key>
    <dict>
        <key>gmsm-server.example.com</key>
        <dict>
            <!-- 允许国密密码套件 -->
            <key>NSEnforcedTransportProtocolRestrictions</key>
            <array>
                <string>TLSv1.2</string>
            </array>
            <!-- 允许自定义证书链 -->
            <key>NSIncludesSubdomains</key>
            <true/>
            <key>NSTemporaryExceptionMinimumDLSecurityProtocol</key>
            <string>TLSv1.2</string>
        </dict>
    </dict>
</dict>

import Foundation
import Security

class GmTrustEvaluator: NSObject, URLSessionDelegate {
    
    func urlSession(
        _ session: URLSession,
        didReceive challenge: URLAuthenticationChallenge,
        completionHandler: @escaping (URLSession.AuthChallengeDisposition, 
                                    URLCredential?) -> Void
    ) {
        guard let serverTrust = challenge.protectionSpace.serverTrust else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        // 验证服务器证书链
        var error: CFError?
        let policy = SecPolicyCreateSSL(true, 
            challenge.protectionSpace.host as CFString)
        SecTrustSetPolicies(serverTrust, policy)
        
        var trustResult: SecTrustResultType = .unspecified
        SecTrustEvaluate(serverTrust, &trustResult)
        
        if trustResult == .unspecified || trustResult == .proceed {
            // 接受服务器证书
            let credential = URLCredential(trust: serverTrust)
            completionHandler(.useCredential, credential)
        } else {
            // 拒绝证书
            completionHandler(.cancelAuthenticationChallenge, nil)
        }
    }
}

import UIKit
import Security

class CertificateManager {
    
    // 从Bundle加载P12证书
    func loadClientCertificate(from bundlePath: String, 
                               password: String) -> SecCertificate? {
        guard let data = NSData(contentsOfFile: bundlePath),
              let identityAndChain = SecPKCS12Import(data as Data, 
              [kSecImportExportPassphrase as String: password] as CFDictionary) else {
            return nil
        }
        
        // 提取第一个证书
        let items = identityAndChain as [[String: Any]]
        guard let item = items.first,
              let certData = item[kSecCertificateItem as String] as? Data else {
            return nil
        }
        
        return SecCertificateCreateWithData(nil, certData as CFData)
    }
    
    // 存储到Keychain
    func saveToKeychain(_ certificate: SecCertificate, 
                        label: String) -> Bool {
        let query: [String: Any] = [
            kSecClass as String: kSecClassCertificate,
            kSecValueRef as String: certificate,
            kSecAttrLabel as String: label,
            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
        ]
        
        SecItemDelete(query as CFDictionary)
        let status = SecItemAdd(query as CFDictionary, nil)
        return status == errSecSuccess
    }
}