element-hq / element-hq/element-android
[SDK] PinnedTrustManager checks only one item from certificates chain
- Dominant language
- Kotlin
- Stars
- 3.7k
- Forks
- 917
- PR merge metrics
- No merged PRs in 30d
Description
When implementing chat functionality for a client I've faced issue with certificate pinning in matrix sdk. I have server root certificate fingerprint, which I pass to config via `withAllowedFingerPrints` method, I set 'withPin' option, but still all requests ends up with `UnrecognizedCertificateException`.
Problem is caused by the thing, that on the server side we use Let's encrypt with short living certificates at the bottom of the chain, and `PinnedTrustManagerApi24` in `checkTrusted' checks only that last certificate instead of going up through the chain till it meets root certificate, like from my understanding it should do.
So I think it's a bug, that mentioned method checks only last item of the chain, instead of going through whole certificates chain and test if any of them matches allowed fingerprints.
Contributor guide
Assessment
This issue has not been assessed yet.