How do you test certificate pinning with Alamofire?

Question

So I followed Alamofire's instructions on the Read Me regarding their new Server Trust Policy. Got the certificate from the server, added it to my project and implemented the following code in my project:

let serverTrustPolicies: [String: ServerTrustPolicy] = [
        "someserver.withvalidcer.com": .PinCertificates(
            certificates: ServerTrustPolicy.certificatesInBundle(),
            validateCertificateChain: true,
            validateHost: true
        )
    ]

    let manager = Manager(
        configuration: NSURLSessionConfiguration.defaultSessionConfiguration(),
        serverTrustPolicyManager: ServerTrustPolicyManager(policies: serverTrustPolicies)
    )

My question is how do I test this?

I've tried changing my base api url to our test server, which has a different valid certificate, but the api calls are not being rejected. And I have verified that the code is running on the required api calls.

Answer 1

Great question!

I would recommend trying to use some proxy software to try to get in the middle of the API calls (Charles Proxy, Burp, etc.). When pinning is enabled, all the network requests should fail since the proxy software will be serving you the incorrect certificate. Then, if you disable certificate pinning, the service calls should work properly going through the proxy.

Another way would be to temporarily change the certificate on the server and you should see the web services fail also.