petrdvorak
commented
2 years ago Hello @fmestre01, thank you for reporting the issue! After a quick analysis and brief understanding of the problem, I can suggest the following:
- Consider using the Mobile Utility Server component instead of static a JSON file. It allows easier deployment and certificate fingerprint management, and the signatures provided by this active component are better, since we sign entire JSON payload instead of just individual records.
- To enforce certificate update in the app, consider using
UpdateMode.FORCEDwhen updating thecertStoredata. This will always download a new set of certificates from the server. For banking apps, this would be our recommendation anyway - the overhead is relatively small and I believe the security improvement of the strict certificate verification is worth the additional call. - Implement Global Validation Observer and add it to the CertStore. This way, you will learn about certificate failures that happen during the app lifetime and you will be able to update the CertStore on first failure.
Also, please do not hesitate to schedule a technical call with us to discuss implementation details - we will be happy to advice with implementation:
fmestre01
Hello, how are you? we are integrating the wultra component in one of our apps but we are having doubts about updating certificates. The "periodicUpdateIntervalMillis" parameter is apparently not working. How can we guarantee that whenever the certificate is renewed on the server (.json) the component will read it please.