Support for TCP?

[eladav]

Hey,
In our app we use a library called CocoaAsyncSocket and we want to use your library to perform certificate pinning on our TLS secured TCP connection (I couldn't find a way to properly do it in CocoaAsyncSocket's docs).
Is it possible to do that?

Thanks,
Elad

[nabla-c0d3]

Hello,
Yes it is possible:

• You need to enable and use the socket:didReceiveTrust:completionHandler method (https://github.com/robbiehanson/CocoaAsyncSocket/blob/master/Source/GCD/GCDAsyncSocket.h#L1206) to receive the server's SecTrustRef object.
• Then you can pass the trust object to [TSKPinningValidator evaluateTrust:forHostname:] (https://datatheorem.github.io/TrustKit/documentation/Classes/TSKPinningValidator.html#//api/name/evaluateTrust:forHostname:). Be very careful when doing so as evaluateTrust:forHostname: will not check the certificate at all if the domain is not pinned, and you will need to do it manually or your App will be insecure. Look for TSKTrustDecisionDomainNotPinned as the return value.

[eladav]

Thank you!
I'll try it out and be back with the results.

[nabla-c0d3]

Great! Let me know how it goes.

[eladav]

Worked great and was very convenient to use. Thanks for the great lib!