search

WirecardMobileServices / acceptSDK

⛔️ DEPRECATED accept by Wirecard mPOS SDK
MIT License
6 stars 10 forks source link

Certificate issue #24

Open vytautasgimbutas opened 7 years ago

vytautasgimbutas commented 7 years ago

Hello, I see that you have updated SSL certificates 14 days ago https://github.com/WirecardMobileServices/acceptSDK/commit/8be22416951ee50de9c9201e6755e9942cd56b86. Is this only related with development version or this means that every user who uses an app with this SDK will have to update every year an app and it might stop working?

WirecardMobileServices commented 7 years ago

Hi,

Actually the certificates for two production servers were updated on 13/08/2017 and comms were sent to our integration partners by our Product Manager that their application using the SDK needs to be updated.

The next commit you are referring to is related to cert update on the sdk-integration (test) server - so that's just for the integrator tests app that will need to update.

Can you let me know which integration partner and email address shall be used for notifications ?

The expiry date on production is now Aug/2019 - and we will inform at least 50 days in advance that cert update is going to happen.

We are considering changing the certification pinning so that CA root is used instead, which would prolong the period for cert update - save the cases where the cert might have been compromised

vytautasgimbutas commented 7 years ago

We are currently not in production. I'll let know my management that they need to send you an email about notification subscription. I suppose this does not affect Android because we didn't have any issues?

Personally I'd highly recommend to solve this in a way it wouldn't require an update each year. 50 days might be sometimes not enough time to update the app. Sometimes we see users using 6 month old app. :) Anyways, for now we will handle this error and prompt user to update their app if this happens.

Thanks for swift response.

WirecardMobileServices commented 7 years ago

Actually Android implemented SSL pinning in 1.5.7 - so can you check which version of Android SDK you have got?

vytautasgimbutas commented 7 years ago

Strange. We're using 1.5.9 version and didn't need to upgrade like iOS.

WirecardMobileServices commented 7 years ago

Strange, will ask our Android devs to check on their keystore :) and how is it used