2

I want to implement ssl pinning (pinning public key) in my project. To do that, i use react-native-ssl-pinning.

I follow the instructions to install, and it works well with android.

However, on iOS, I always get an error "Cancelled". When run from xcode, I get this error:

HTTP load failed, 0/0 bytes (error code: -999 [1:89])

It seems to be a problem with the certificate, but I can't identify it.

According to apple's documentation, the certificate must:

  1. have a keysize greater or equal to 2048 bits
  2. use algorithm of SHA-2 family
  3. present the DNS name of the server in the Subject Alternative Name extension
  4. contain an ExtendedKeyUsage (EKU) extension containing the id-kp-serverAuth OID
  5. have a validity period of 825 days or fewer (as expressed in the NotBefore and NotAfter fields of the certificate).

The certificate I use seems to be valid, and I decided to ask here if someone has a working solution or at least a hint after searching unsuccessfully myself.

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
Sylvain
  • 509
  • 1
  • 7
  • 17
  • Hey, I was able to implement ssl pinning in my react-native project but instead of using that i used Trustkit. Here's my StackOverflow question: https://stackoverflow.com/questions/57755446/implementing-ssl-pinning-in-a-react-native-application-using-trustkit-ios For Android you can use TrustKit Android: https://github.com/datatheorem/TrustKit-Android Both method works for me – Auticcat Feb 24 '20 at 13:53
  • Hi, thanks I will check out this solution – Sylvain Feb 24 '20 at 15:10
  • If you need i can write it down again if you can't get it to work! – Auticcat Feb 24 '20 at 18:34
  • 1
    Thanks, i could make it work using this package: react-native-cert-pinner – Sylvain Feb 25 '20 at 10:31
  • @Auticcat we are in the same situation and unfortunately we have no idea how to implement certificate pinning in both iOS and Android using TrustKit. Can you give some example here on which we can study the implementation? – shogitai Jun 15 '20 at 15:40
  • @shogitai I highly recommend [this guide](https://itnext.io/react-native-security-ssl-pinning-cde086210d58). I used it to quickly implement public key pinning on both IOS and Android – Dror Bar Jul 13 '21 at 11:19

0 Answers0