element-hq / element-hq/element-android

[SDK] PinnedTrustManager checks only one item from certificates chain

Open
#2,990 0 comments 0 reactions 0 assignees View on GitHub
matrix-sdk
Dominant language
Kotlin
Stars
3.7k
Forks
917
PR merge metrics
No merged PRs in 30d

Description

When implementing chat functionality for a client I've faced issue with certificate pinning in matrix sdk. I have server root certificate fingerprint, which I pass to config via `withAllowedFingerPrints` method, I set 'withPin' option, but still all requests ends up with `UnrecognizedCertificateException`.

Problem is caused by the thing, that on the server side we use Let's encrypt with short living certificates at the bottom of the chain, and `PinnedTrustManagerApi24` in `checkTrusted' checks only that last certificate instead of going up through the chain till it meets root certificate, like from my understanding it should do.

So I think it's a bug, that mentioned method checks only last item of the chain, instead of going through whole certificates chain and test if any of them matches allowed fingerprints.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.