如何在iOS 7中使用SecPolicyCreateRevocation检查x.509吊销

我一直在尝试在不同的时刻使用OCSP和CRL检查iOS 7.0中的X.509证书吊销状态，只要我通过链中的所有证书，评估将返回kSecTrustResultUnspecified（这意味着证书是可信的），而不实际检查OCSP或CRL源。我已经把任何代码，我认为是相关的下面，请帮助

谢谢

PS:ocspOnly和crlOnly是布尔值，表示是否专门使用这些撤销检查方法中的任何一种；certs是一个NSArray，它包含链中除锚证书以外的所有证书；锚点证书在安装之前已正确设置

int evaluationMethod = kSecRevocationRequirePositiveResponse;

if (ocspOnly) {
    evaluationMethod |= kSecRevocationOCSPMethod;
} else if (crlOnly) {
    evaluationMethod |= kSecRevocationCRLMethod;
} else {
    evaluationMethod |= kSecRevocationUseAnyAvailableMethod;
}


if ((status = SecTrustCreateWithCertificates((__bridge CFArrayRef)certs, SecPolicyCreateRevocation(evaluationMethod), &trust)) != errSecSuccess) {
    NSLog(@"Failed to create trust with certificate and policy: %ld", status);
    return NO;
}

if ((status = SecTrustSetNetworkFetchAllowed(trust, YES)) != errSecSuccess) {
    NSLog(@"Failed to activate network fetch: %ld", status);
}


status = SecTrustEvaluate(trust, &trustResult);
if (status != errSecSuccess) {
    NSLog(@"Failed to evaluate trust: %ld", status);
    return NO;
}

if (trustResult == kSecTrustResultProceed || trustResult == kSecTrustResultUnspecified)
    return YES;
return NO;

---

PS-2：这个问题在iOS开发者论坛上也被问到。

我看到了同样的行为。在iOS上，它似乎没有尝试评估CRL，