I am implementing SSL pinning as a security requirement for a project and the HTTPS endpoint is giving me SslPolicyErrors. The following errors occur,
RemoteCertificateChainErrors
RevocationStatusUnknown
UntrustedRoot
This only occurs for our QA endpoint and not our PROD endpoint so I think there could be an issue with the certificate. Both have a certificate chain.
If I ignore these issues and just check that the public key certificate.GetPublicKeyString ()
matches, will that be secure, or will hackers be able to spoof our certificate because we are not checking the chain?
Here's the code that checks for SslPolicyErrors that I am considering removing.
if (sslPolicyErrors != SslPolicyErrors.None) {
Debug.Log(sslPolicyErrors);
for(int i=0; i<chain.ChainStatus.Length;i++){
Debug.Log("-");
Debug.Log(chain.ChainStatus[i].Status);
Debug.Log(chain.ChainStatus[i].StatusInformation);
}
return false;
}
Here's the sample .NET code from OWASP.
ServicePointManager.ServerCertificateValidationCallback = PinPublicKey;
-
public static bool PinPublicKey(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) {
if (certificate == null || chain == null)
return false;
if (sslPolicyErrors != SslPolicyErrors.None)
return false;
// Verify against known public key within the certificate
String pk = certificate.GetPublicKeyString();
if (pk.Equals(PUB_KEY))
return true;
return false;
}