So I am using Android TrustKit to pin certificate’s Subject Public Key Info. One of the security guys suggested I pin modulus of the public key, however, I cannot find any sort of examples on how to do that. Here is my current Android code:
OkHttpClient.Builder()
.apply {
authenticator?.let(::authenticator)
interceptor?.let(::addInterceptor)
if (config.certificatePin) {
sslSocketFactory(TrustKit.getInstance().getSSLSocketFactory(serverHostname),
TrustKit.getInstance().getTrustManager(serverHostname))
}
}
...
I also know how to obtain modulus of the certificate with openssl x509
command in command line. But I can’t figure out how do I pin that data inside the android application. Any ideas or code samples would be appreciated.