Option to not enforce Certificate pinning

[shenoymukesh]

I am using Okhttp + Retrofit for networking in my SDK. I have a requirement to implement Certificate pinning but not enforce it. We just need to get the failure reports for pinning failure and would like the connection to go through for now during the monitoring period.
TrustKit is another Certificate pinning library which provides this option to set enforce = false. With this, the connection itself wouldn't fail but we can get the failure reports.

I do not see a way to achieve similar behavior using the Okhttp CertificatePinner. Are there any plans to add this functionality?
Or do you have any suggestions on how I can achieve this behavior using the existing functionality?

Would have been easier if we could extend CertificatePinner class and override check() ?

Thanks in advance.

[yschimke]

As a Temporary Workaround, you could implement yourself on top of X509Certificate from the handshake.

As an enhancement, it's a valid feature request, but not sure about a logging only mode for CertificatePinner, it is probably not something we would want to do. There is a related request #3010 to allow pins to expire for old client builds.

Alternatively a clean solution based on Pins API could be implemented as a custom Interceptor, if we exposed Pins as a public api requested here #4049.

[shenoymukesh]

@yschimke Thanks for responding.
Sorry I am not clear about approach you suggested. Are you saying that I can implement the pinning on my own in a custom interceptor and not do the OkHttpClient.Builder().certificatePinner(certificatePinner) ?
Because if I set the CertificatePinner to OkHttp client, then it would always throw SSLPeerUnverifiedException in case of pinning failure and fail the request. So I will have no way to proceed with request.

[yschimke]

Yep. Giving you a temporary workaround if you want something sooner.

[shenoymukesh]

@yschimke Does below code make sense?

`

class CustomCertCheckInterceptor(val certificatePinner: CertificatePinner) : Interceptor {

override fun intercept(chain: Interceptor.Chain): Response {
    val host = chain.request().url.host
    val certs = chain.connection()?.handshake()?.peerCertificates ?: emptyList()

    try {
        certificatePinner.check(host, certs)
    } catch (e: SSLPeerUnverifiedException) {
        //Do the logging and reporting for pinning failure
    }
    return chain.proceed(chain.request())
}

}

`

[yschimke]

@shenoymukesh Yeah - that wasn't even what I meant. But that is way simpler and looks great.

[shenoymukesh]

@yschimke Thanks.
But my concern with above implementation is that I am not directly using OkHttp provided Cert pinning functionality directly here. Instead I am trying to imitate it by calling certificatePinner.check(host, certs) myself, outside of actual connection class.
So it looks kind of hacky to me. Do you have any comments?

Also I did not understand in your earlier response, how could #4049 help in this case?

[yschimke]

#4049 would help only in so much as a public API would probably be a nicer experience, avoid throwing and catching exception. With the current API we clean the certificates twice. But nothing stops your sample code from working, so I think you have a nice solution.

[shenoymukesh]

@yschimke Got it. Thanks for feedback.

[shenoymukesh]

@yschimke , Is there anyway I can get hold of chain.connection()?.handshake()?.peerCertificates in case of Okhttp default Certificate pinning failure?

Basically I would need the peerCertificates in case when Certificate pinning fails for my reporting purposes.

If I enforce Certificate pinning through OkHttpClient.Builder().certificatePinner(certificatePinner), the connection would fail with an SSLPeerUnverifiedException. But in this case my NetworkInterceptor doesn't seem to get invoked. Is it expected?
Where as regular application interceptor gets invoked but then that wouldn't give me chain.connection(). connection would be null.
So what would be best way to get peerCertificates in this case?
Thanks in advance.

[yschimke]

I assumed you just wouldn't set the CertificatePinner on the client, and only use in the Interceptor. What am I missing?

[shenoymukesh]

@yschimke I have two flows.

1. With Cert pinning not enforced, This is just for reporting. I am not setting CertificatePinner here. Planning to it myself using interceptor code above.
2. With Cert pinning enforced. I want the request to fail here and also do reporting. I want to do it by setting the CertificatePinner to OkHttp. I suppose it would be risky to do this on my own in the interceptor.
   So it is for case 2., I am not able to find a way to get hold of connection/handshake/peerCertificates.. after the pinning fails.

[yschimke]

@shenoymukesh You won't be able to easily, we fail in RealConnection.connectTls while doing the handshake. But the exception gives a useful message you can record based on it's specific type. Sorry.

[shenoymukesh]

@yschimke Yeah, right now the only way I see is to rely on Exception. Thanks for the response. I appreciate it.