Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to implement leaf/intermediate certificate pinning in Android?

I have already implemented leaf certificate in my project it's working fine. Please check the below code,now the problem is leaf certificate will expire after one year in my server so I want to validate the leaf certificate so that when it expires/invalid I canto use intermediate certificate?

Is there any example to implement intermediate certificate?

Please help me!

Code:-

SSLContext sslContext = null;
        try {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            InputStream caInput = context.getResources().openRawResource(certRawRef);
            Certificate ca;
            try {
                ca = cf.generateCertificate(caInput);
            } finally {
                caInput.close();
            }
            // Create a KeyStore containing our trusted CAs
            String keyStoreType = KeyStore.getDefaultType();
            KeyStore keyStore = KeyStore.getInstance(keyStoreType);
            keyStore.load(null, null);
            keyStore.setCertificateEntry("ca", ca);
            // Create a TrustManager that trusts the CAs in our KeyStore
            String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
            tmf.init(keyStore);
            // Create an SSLContext that uses our TrustManager

            sslContext = SSLContext.getInstance("TLSv1.2");
            sslContext.init(null, tmf.getTrustManagers(), null);
            return sslContext;
        } catch (Exception e) {
            Log.e("EXCEPTION",e.toString());
            //Print here right certificate failure issue
        }
like image 523
User6006 Avatar asked Apr 25 '17 06:04

User6006


People also ask

How does SSL pinning work in Android?

Once you know a host's certificate or public key, you pin it to that host. In other words, you configure the app to reject all but one or a few predefined certificates or public keys. Whenever the app connects to a server, it compares the server certificate with the pinned certificate(s) or public key(s).

What is leaf pinning?

The pinning of a leaf certificate virtually assures a certificate match. Leaf certificates — also known as end-user or end-entity certificates — should typically be revoked and replaced fairly often, requiring corresponding updates to all client applications.


1 Answers

Finally i found the Answer:-

try {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            InputStream caInputLeaf = context.getResources().openRawResource(leafCert);
            InputStream caInputInter = context.getResources().openRawResource(interCert);
            try {
                if (cf != null) {
                    ca = cf.generateCertificate(caInputLeaf);

                    URL url = new URL(URL);
                    HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
                    conn.setRequestMethod("GET");
                    conn.connect();

                    chain = conn.getServerCertificates();
                    if(chain!=null && chain[0].equals(ca)) {           //Return Leaf certificate
                        return ca;
                    }
                    else{                                   //Return Intermediate certificate
                        ca = cf.generateCertificate(caInputInter);
                        return ca;
                    }
                }
            } catch (Exception cee) {
                ca = cf.generateCertificate(caInputInter);
                return ca;
            }
        } catch (Exception e) {
            Log.e("EXCEPTION", e.toString());
        }
like image 151
User6006 Avatar answered Oct 07 '22 02:10

User6006