datatheorem / TrustKit-Android

Easy SSL pinning validation and reporting for Android.
MIT License
583 stars 87 forks source link

Why must hash SubjectPublicKeyInfo not public key? #79

Closed LuckyRoc closed 3 years ago

yschimke commented 3 years ago

IIUC Certificates can be reissued/extended, but the chain is still semantically equivalent. The key on it's own would allow the details to be changed.

https://tools.ietf.org/html/rfc7469#section-2.4 https://www.imperialviolet.org/2011/05/04/pinning.html