android - Trust anchor for certification path not found with okhttp -
so i've been trying night make work, nothing seems trick ... keep getting trust anchor certification path not found.
here how i'm build okhttpclient (i followed https://medium.com/@sreekumar_av/certificate-public-key-pinning-in-android-using-retrofit-2-0-74140800025b)
fun provideokhttpclient(): okhttpclient { val httpclientbuilder = okhttpclient() .newbuilder() val logging = httplogginginterceptor() logging.level = if (buildconfig.debug) httplogginginterceptor.level.body else httplogginginterceptor.level.none val certificatepinner = certificatepinner.builder() .add(host, sha) .build() val connectionspec = connectionspec.builder(connectionspec.modern_tls) connectionspec.tlsversions(tlsversion.tls_1_2).build() val tlssocketfactory = tlssocketfactory() return httpclientbuilder .certificatepinner(certificatepinner) .addnetworkinterceptor(logging) .sslsocketfactory(tlssocketfactory, tlssocketfactory.systemdefaulttrustmanager()) .connectionspecs(collections.singletonlist(connectionspec.build())) .build() }
i got sha this: openssl s_client -connect host:port | openssl x509 -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
and here tlsfacotry: https://gist.github.com/pollux-/fbcc74984e110bb49497faa2d0ed5ee1#file-tlssocketfactory-java
i don't why doesn't work @ point..
any appreciated!
iirc certificate pinning evaluated after certificate chain accepted.
it have full stacktrace, , host trying connect to, since possible using self signed certificate client won't accept.
try working without certificate pinning first, add in. @commonsware mentions when certificate pinning fails tells do.
Comments
Post a Comment