diff --git a/README.md b/README.md index 54c3d7d..e7a9ca5 100644 --- a/README.md +++ b/README.md @@ -69,6 +69,30 @@ https://stackoverflow.com/questions/7885785/using-openssl-to-get-the-certificate #### iOS - drag mycert.cer to Xcode project, mark your target and 'Copy items if needed' - (skip this if you are using certificate pinning) no extra step needed for public key pinning, AFNetworking will extract the public key from the certificate. + - Using `der` base64 encoded: + - Create `der` certificate: + ```bash + openssl x509 -in cert.pem -outform der | base64 + ``` + - To validate: + ```bash + echo "BASE64_CERT" | base64 -d | openssl x509 -inform der -text -noout + ``` + - Sample on JS side + ```javascript + fetch("https://publicobject.com", { + method: "GET" , + pkPinning: true, + sslPinning: { + certs: [ + "MIIC2DCCAcCgAwIBAgIBATANBgkqh....", + "MIIGvjCCBaagAwIBAgIQD7YO9foj3...." + ] + } + }) + ``` + Notes: iOS uses Base64 `der` certificates, while Android uses public key pinning. + #### Android - Only if using certificate pinning : place your .cer files under src/main/assets/ diff --git a/ios/RNSslPinning/RNSslPinning.m b/ios/RNSslPinning/RNSslPinning.m index 3179a72..dee01d6 100644 --- a/ios/RNSslPinning/RNSslPinning.m +++ b/ios/RNSslPinning/RNSslPinning.m @@ -217,6 +217,35 @@ -(void) performMultipartRequest: (AFURLSessionManager*)manager obj:(NSDictionary BOOL disableAllSecurity = [[obj objectForKey:@"disableAllSecurity"] boolValue]; NSSet *certificates = [AFSecurityPolicy certificatesInBundle:[NSBundle mainBundle]]; + NSDictionary *sslPinning = [obj objectForKey:@"sslPinning"]; + NSArray *certs = nil; + NSMutableSet *certDataSet = [NSMutableSet set]; + + if ([sslPinning isKindOfClass:[NSDictionary class]]) { + id certsValue = [sslPinning objectForKey:@"certs"]; + if ([certsValue isKindOfClass:[NSArray class]]) { + BOOL allStrings = YES; + for (id item in (NSArray *)certsValue) { + if (![item isKindOfClass:[NSString class]]) { + allStrings = NO; + break; + } + } + if (allStrings) { + certs = (NSArray *)certsValue; + } + } + } + + for (NSString *base64Cert in certs) { + NSData *certData = [[NSData alloc] initWithBase64EncodedString:base64Cert + options:NSDataBase64DecodingIgnoreUnknownCharacters]; + if (certData) { + [certDataSet addObject:certData]; + } else { + NSLog(@"⚠️ Failed to decode certificate."); + } + } // set policy (ssl pinning) if(disableAllSecurity){ @@ -225,7 +254,7 @@ -(void) performMultipartRequest: (AFURLSessionManager*)manager obj:(NSDictionary policy.allowInvalidCertificates = true; } else if (pkPinning){ - policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey withPinnedCertificates:certificates]; + policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate withPinnedCertificates:certDataSet]; } else{ policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate withPinnedCertificates:certificates];