text: // AFSecurityPolicy.h
  
  #import <Foundation/Foundation.h>
  #import <Security/Security.h>
  
  /**
   验证服务器是否被信任的方式
  
   - AFSSLPinningModeNone:        默认的认证方式，只会在系统的信任的证书列表中对服务器返回的证书进行验证
   - AFSSLPinningModePublicKey:   需要客户端预先保存服务器的证书
   - AFSSLPinningModeCertificate: 也需要预先保存服务端发送的证书，但是这里只会验证证书中的公钥是否正确
   */
  typedef NS_ENUM(NSUInteger, AFSSLPinningMode) {
      AFSSLPinningModeNone,
      AFSSLPinningModePublicKey,
      AFSSLPinningModeCertificate,
  };
  
  /**
   `AFSecurityPolicy` evaluates server trust against pinned X.509 certificates and public keys over secure connections.
  
   Adding pinned SSL certificates to your app helps prevent man-in-the-middle attacks and other vulnerabilities. Applications dealing with sensitive customer data or financial information are strongly encouraged to route all communication over an HTTPS connection with SSL pinning configured and enabled.
   */
  
  NS_ASSUME_NONNULL_BEGIN
  
  /**
   AFSecurityPolicy主要作用就是验证HTTPS请求的证书是否有效，如果app中一些敏感信息或者涉及交易信息，一定要使用HTTPS来保证交易或者用户信息的安全
   
   AFSecurityPolicy 同样也作为一个即插即用的模块，在 AFNetworking 中作为验证 HTTPS 证书是否有效的模块存在
   */
  @interface AFSecurityPolicy : NSObject <NSSecureCoding, NSCopying>
  
  /**
   The criteria by which server trust should be evaluated against the pinned SSL certificates. Defaults to `AFSSLPinningModeNone`.
   */
  @property (readonly, nonatomic, assign) AFSSLPinningMode SSLPinningMode;
  
  /**
   The certificates used to evaluate server trust according to the SSL pinning mode. 
  
    By default, this property is set to any (`.cer`) certificates included in the target compiling AFNetworking. Note that if you are using AFNetworking as embedded framework, no certificates will be pinned by default. Use `certificatesInBundle` to load certificates from your target, and then create a new policy by calling `policyWithPinningMode:withPinnedCertificates`.
   
   Note that if pinning is enabled, `evaluateServerTrust:forDomain:` will return true if any pinned certificate matches.
   */
  @property (nonatomic, strong, nullable) NSSet <NSData *> *pinnedCertificates;
  
  /**
   Whether or not to trust servers with an invalid or expired SSL certificates. Defaults to `NO`.
   */
  @property (nonatomic, assign) BOOL allowInvalidCertificates;
  
  /**
   Whether or not to validate the domain name in the certificate's CN field. Defaults to `YES`.
   */
  @property (nonatomic, assign) BOOL validatesDomainName;
  
  ///-----------------------------------------
  /// @name Getting Certificates from the Bundle
  ///-----------------------------------------
  
  /**
   Returns any certificates included in the bundle. If you are using AFNetworking as an embedded framework, you must use this method to find the certificates you have included in your app bundle, and use them when creating your security policy by calling `policyWithPinningMode:withPinnedCertificates`.
  
   @return The certificates included in the given bundle.
   */
  + (NSSet <NSData *> *)certificatesInBundle:(NSBundle *)bundle;
  
  ///-----------------------------------------
  /// @name Getting Specific Security Policies
  ///-----------------------------------------
  
  /**
   Returns the shared default security policy, which does not allow invalid certificates, validates domain name, and does not validate against pinned certificates or public keys.
  
   @return The default security policy.
   */
  + (instancetype)defaultPolicy;
  
  ///---------------------
  /// @name Initialization
  ///---------------------
  
  /**
   Creates and returns a security policy with the specified pinning mode.
  
   @param pinningMode The SSL pinning mode.
  
   @return A new security policy.
   */
  + (instancetype)policyWithPinningMode:(AFSSLPinningMode)pinningMode;
  
  /**
   Creates and returns a security policy with the specified pinning mode.
  
   @param pinningMode The SSL pinning mode.
   @param pinnedCertificates The certificates to pin against.
  
   @return A new security policy.
   */
  + (instancetype)policyWithPinningMode:(AFSSLPinningMode)pinningMode withPinnedCertificates:(NSSet <NSData *> *)pinnedCertificates;
  
  ///------------------------------
  /// @name Evaluating Server Trust
  ///------------------------------
  
  /**
   Whether or not the specified server trust should be accepted, based on the security policy.
  
   This method should be used when responding to an authentication challenge from a server.
  
   @param serverTrust The X.509 certificate trust of the server.
   @param domain The domain of serverTrust. If `nil`, the domain will not be validated.
  
   @return Whether or not to trust the server.
   */
  - (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust
                    forDomain:(nullable NSString *)domain;
  
  @end
  
  NS_ASSUME_NONNULL_END
  
  ///----------------
  /// @name Constants
  ///----------------
  
  /**
   ## SSL Pinning Modes
  
   The following constants are provided by `AFSSLPinningMode` as possible SSL pinning modes.
  
   enum {
   AFSSLPinningModeNone,
   AFSSLPinningModePublicKey,
   AFSSLPinningModeCertificate,
   }
  
   `AFSSLPinningModeNone`
   Do not used pinned certificates to validate servers.
  
   `AFSSLPinningModePublicKey`
   Validate host certificates against public keys of pinned certificates.
  
   `AFSSLPinningModeCertificate`
   Validate host certificates against pinned certificates.
  */
  