Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,30 @@ https://stackoverflow.com/questions/7885785/using-openssl-to-get-the-certificate
#### iOS
- drag mycert.cer to Xcode project, mark your target and 'Copy items if needed'
- (skip this if you are using certificate pinning) no extra step needed for public key pinning, AFNetworking will extract the public key from the certificate.
- Using `der` base64 encoded:
- Create `der` certificate:
```bash
openssl x509 -in cert.pem -outform der | base64
```
- To validate:
```bash
echo "BASE64_CERT" | base64 -d | openssl x509 -inform der -text -noout
```
- Sample on JS side
```javascript
fetch("https://publicobject.com", {
method: "GET" ,
pkPinning: true,
sslPinning: {
certs: [
"MIIC2DCCAcCgAwIBAgIBATANBgkqh....",
"MIIGvjCCBaagAwIBAgIQD7YO9foj3...."
]
}
})
```
Notes: iOS uses Base64 `der` certificates, while Android uses public key pinning.


#### Android
- Only if using certificate pinning : place your .cer files under src/main/assets/
Expand Down
31 changes: 30 additions & 1 deletion ios/RNSslPinning/RNSslPinning.m
Original file line number Diff line number Diff line change
Expand Up @@ -217,6 +217,35 @@ -(void) performMultipartRequest: (AFURLSessionManager*)manager obj:(NSDictionary
BOOL disableAllSecurity = [[obj objectForKey:@"disableAllSecurity"] boolValue];

NSSet *certificates = [AFSecurityPolicy certificatesInBundle:[NSBundle mainBundle]];
NSDictionary *sslPinning = [obj objectForKey:@"sslPinning"];
NSArray<NSString *> *certs = nil;
NSMutableSet *certDataSet = [NSMutableSet set];

if ([sslPinning isKindOfClass:[NSDictionary class]]) {
id certsValue = [sslPinning objectForKey:@"certs"];
if ([certsValue isKindOfClass:[NSArray class]]) {
BOOL allStrings = YES;
for (id item in (NSArray *)certsValue) {
if (![item isKindOfClass:[NSString class]]) {
allStrings = NO;
break;
}
}
if (allStrings) {
certs = (NSArray<NSString *> *)certsValue;
}
}
}

for (NSString *base64Cert in certs) {
NSData *certData = [[NSData alloc] initWithBase64EncodedString:base64Cert
options:NSDataBase64DecodingIgnoreUnknownCharacters];
if (certData) {
[certDataSet addObject:certData];
} else {
NSLog(@"⚠️ Failed to decode certificate.");
}
}

// set policy (ssl pinning)
if(disableAllSecurity){
Expand All @@ -225,7 +254,7 @@ -(void) performMultipartRequest: (AFURLSessionManager*)manager obj:(NSDictionary
policy.allowInvalidCertificates = true;
}
else if (pkPinning){
policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey withPinnedCertificates:certificates];
policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate withPinnedCertificates:certDataSet];
}
else{
policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate withPinnedCertificates:certificates];
Expand Down