AFHTTPRequestOperationManager *manager = [AFHTTPRequestOperationManager manager]; 

 AFSecurityPolicy *securityPolicy = [[AFSecurityPolicy alloc] init];

 [securityPolicy setAllowInvalidCertificates:NO];

 [securityPolicy setSSLPinningMode:AFSSLPinningModeCertificate];

 [securityPolicy setValidatesDomainName:YES];

 [securityPolicy setValidatesCertificateChain:NO]; 

 manager.securityPolicy = securityPolicy;

 // 在证书中获取公钥

 static id AFPublicKeyForCertificate(NSData *certificate) {

     id allowedPublicKey = nil;

     SecCertificateRef allowedCertificate;

     SecCertificateRef allowedCertificates[];

     CFArrayRef tempCertificates = nil;

     SecPolicyRef policy = nil;

     SecTrustRef allowedTrust = nil;

     SecTrustResultType result;

     // 1. 根据二进制的certificate生成SecCertificateRef类型的证书

     // NSData *certificate 通过CoreFoundation (__bridge CFDataRef)转换成 CFDataRef

     // 看下边的这个方法就可以知道需要传递参数的类型

     /*

      SecCertificateRef SecCertificateCreateWithData(CFAllocatorRef __nullable allocator,

      CFDataRef data) __OSX_AVAILABLE_STARTING(__MAC_10_6, __IPHONE_2_0);

      */

     allowedCertificate = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certificate);

     // 2.如果allowedCertificate为空，则执行标记_out后边的代码

     __Require_Quiet(allowedCertificate != NULL, _out);

     // 3.给allowedCertificates赋值

     allowedCertificates[] = allowedCertificate;

     // 4.新建CFArra： tempCertificates

     tempCertificates = CFArrayCreate(NULL, (const void **)allowedCertificates, , NULL);

     // 5. 新建policy为X.509

     policy = SecPolicyCreateBasicX509();

     // 6.创建SecTrustRef对象，如果出错就跳到_out标记处

     __Require_noErr_Quiet(SecTrustCreateWithCertificates(tempCertificates, policy, &allowedTrust), _out);

     // 7.校验证书的过程，这个不是异步的。

     __Require_noErr_Quiet(SecTrustEvaluate(allowedTrust, &result), _out);

     // 8.在SecTrustRef对象中取出公钥

     allowedPublicKey = (__bridge_transfer id)SecTrustCopyPublicKey(allowedTrust);

 _out:

     if (allowedTrust) {

         CFRelease(allowedTrust);

     }

     if (policy) {

         CFRelease(policy);

     }

     if (tempCertificates) {

         CFRelease(tempCertificates);

     }

     if (allowedCertificate) {

         CFRelease(allowedCertificate);

     }

     return allowedPublicKey;

 }

 - (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust

                   forDomain:(NSString *)domain

 {

     if (domain && self.allowInvalidCertificates && self.validatesDomainName && (self.SSLPinningMode == AFSSLPinningModeNone || [self.pinnedCertificates count] == )) {

         // https://developer.apple.com/library/mac/documentation/NetworkingInternet/Conceptual/NetworkingTopics/Articles/OverridingSSLChainValidationCorrectly.html

         //  According to the docs, you should only trust your provided certs for evaluation.

         //  Pinned certificates are added to the trust. Without pinned certificates,

         //  there is nothing to evaluate against.

         //

         //  From Apple Docs:

         //          "Do not implicitly trust self-signed certificates as anchors (kSecTrustOptionImplicitAnchors).

         //           Instead, add your own (self-signed) CA certificate to the list of trusted anchors."

         NSLog(@"In order to validate a domain name for self signed certificates, you MUST use pinning.");

         return NO;

     }

     NSMutableArray *policies = [NSMutableArray array];

     if (self.validatesDomainName) {

         [policies addObject:(__bridge_transfer id)SecPolicyCreateSSL(true, (__bridge CFStringRef)domain)];

     } else {

         [policies addObject:(__bridge_transfer id)SecPolicyCreateBasicX509()];

     }

     SecTrustSetPolicies(serverTrust, (__bridge CFArrayRef)policies);

     // AFSSLPinningModeNone 不校验证书，

     if (self.SSLPinningMode == AFSSLPinningModeNone) {

         return self.allowInvalidCertificates || AFServerTrustIsValid(serverTrust);

     } else if (!AFServerTrustIsValid(serverTrust) && !self.allowInvalidCertificates) {

         return NO;

     }

     // 代码能够走到这里说明两点

     // 1.通过了根证书的验证

     // 2.allowInvalidCertificates = YES

     switch (self.SSLPinningMode) {

         case AFSSLPinningModeNone:

         default:

             return NO;

         case AFSSLPinningModeCertificate: { // 全部校验

             NSMutableArray *pinnedCertificates = [NSMutableArray array];

             for (NSData *certificateData in self.pinnedCertificates) {

                 [pinnedCertificates addObject:(__bridge_transfer id)SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certificateData)];

             }

             // 把本地的证书设为根证书，即服务器应该信任的证书

             SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)pinnedCertificates);

             // 校验能够信任

             if (!AFServerTrustIsValid(serverTrust)) {

                 return NO;

             }

             // obtain the chain after being validated, which *should* contain the pinned certificate in the last position (if it's the Root CA)

             NSArray *serverCertificates = AFCertificateTrustChainForServerTrust(serverTrust);

             //  判断本地证书和服务器证书是否相同

             for (NSData *trustChainCertificate in [serverCertificates reverseObjectEnumerator]) {

                 if ([self.pinnedCertificates containsObject:trustChainCertificate]) {

                     return YES;

                 }

             }

             return NO;

         }

         case AFSSLPinningModePublicKey: {

             NSUInteger trustedPublicKeyCount = ;

             NSArray *publicKeys = AFPublicKeyTrustChainForServerTrust(serverTrust);

             // 找到相同的公钥就通过

             for (id trustChainPublicKey in publicKeys) {

                 for (id pinnedPublicKey in self.pinnedPublicKeys) {

                     if (AFSecKeyIsEqualToKey((__bridge SecKeyRef)trustChainPublicKey, (__bridge SecKeyRef)pinnedPublicKey)) {

                         trustedPublicKeyCount += ;

                     }

                 }

             }

             return trustedPublicKeyCount > ;

         }

     }

     return NO;

 }

 #pragma mark - NSKeyValueObserving

 + (NSSet *)keyPathsForValuesAffectingPinnedPublicKeys {

     return [NSSet setWithObject:@"pinnedCertificates"];

 }

 #pragma mark - NSSecureCoding

 + (BOOL)supportsSecureCoding {

     return YES;

 }

 - (instancetype)initWithCoder:(NSCoder *)decoder {

     self = [self init];

     if (!self) {

         return nil;

     }

     self.SSLPinningMode = [[decoder decodeObjectOfClass:[NSNumber class] forKey:NSStringFromSelector(@selector(SSLPinningMode))] unsignedIntegerValue];

     self.allowInvalidCertificates = [decoder decodeBoolForKey:NSStringFromSelector(@selector(allowInvalidCertificates))];

     self.validatesDomainName = [decoder decodeBoolForKey:NSStringFromSelector(@selector(validatesDomainName))];

     self.pinnedCertificates = [decoder decodeObjectOfClass:[NSArray class] forKey:NSStringFromSelector(@selector(pinnedCertificates))];

     return self;

 }

 - (void)encodeWithCoder:(NSCoder *)coder {

     [coder encodeObject:[NSNumber numberWithUnsignedInteger:self.SSLPinningMode] forKey:NSStringFromSelector(@selector(SSLPinningMode))];

     [coder encodeBool:self.allowInvalidCertificates forKey:NSStringFromSelector(@selector(allowInvalidCertificates))];

     [coder encodeBool:self.validatesDomainName forKey:NSStringFromSelector(@selector(validatesDomainName))];

     [coder encodeObject:self.pinnedCertificates forKey:NSStringFromSelector(@selector(pinnedCertificates))];

 }

 #pragma mark - NSCopying

 - (instancetype)copyWithZone:(NSZone *)zone {

     AFSecurityPolicy *securityPolicy = [[[self class] allocWithZone:zone] init];

     securityPolicy.SSLPinningMode = self.SSLPinningMode;

     securityPolicy.allowInvalidCertificates = self.allowInvalidCertificates;

     securityPolicy.validatesDomainName = self.validatesDomainName;

     securityPolicy.pinnedCertificates = [self.pinnedCertificates copyWithZone:zone];

     return securityPolicy;

 }