Closed fmestre01 closed 2 years ago
Hello @fmestre01, thank you for the question! :)
Internally, the SSLPinningX509TrustManager
uses the validateCert
function to check the top-most certificate in the certificate chain. The implementation is not complicated, see the following code for details:
The untrusted certificate does not crash the app. It raises the standard java.security.cert.CertificateException
(as it would in case of any invalid TLS/SSL certificate, i.e., expired certificate or certificate for a wrong domain). You need to handle such exception in your code.
@TomasKypta Feel free to add more context.
Good afternoon, how are you ?
please we have a question related to the SSLPinningX509TrustManager class.
When creating:
is the certificate validation already performed automatically for each request or is it necessary to manually call the validateCert function ?
In the SSLPinningX509TrustManager class whenever a certificate is invalid is it really necessary to launch a crash?