使用Cordova进行证书验证

Question

I wonder if there is a simple/recommended way for verifying the remote site certificate within Cordova. I would like my app to verify $remote.thumbprint is in a list of expected thumbprints and no one MITMs. The code (and the list) should be deployed on the phone through the app stores (I just assume they are trusted).

Preferably a straight forward solution that does not require platform specific code for Android, IOS and WP?

Answer 1

In order to see the cert information on a remote site you have to have access to that remote server. But assuming you have access to the server you could write some server code that returns a list of thumbrint values and what ever else you may need returned. Here is how you could do it with C# using asp.net:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Security.Cryptography;
using System.Security.Permissions;
using System.IO;
using System.Security.Cryptography.X509Certificates;

namespace FIPWS01
{
    public partial class certtest : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {


            try

            {

                X509Store store = new X509Store(StoreLocation.LocalMachine);

                store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);

                X509Certificate2Collection collection = (X509Certificate2Collection)store.Certificates;

               // X509Certificate2Collection fcollection = (X509Certificate2Collection)collection.Find(X509FindType.FindBySubjectName, "Kilpatrick", false);

                X509Certificate2Collection fcollection = (X509Certificate2Collection)collection.Find(X509FindType.FindBySubjectName, "[your info here]", false);

                Response.Write("Number of certificates: " + fcollection.Count + "<br>");

                foreach (X509Certificate2 x509 in fcollection)

                {

                    byte[] rawdata = x509.RawData;

                    Response.Write("Friendly Name: " + x509.FriendlyName + "<br>");

                    Response.Write("Simple Name: " + x509.GetNameInfo(X509NameType.SimpleName, true) +  "<br>");

                    Response.Write("Thumb Print: " + x509.Thumbprint + "<br>");

                }

                store.Close();

            }

            catch (CryptographicException)

                {

                    Response.Write("Information could not be written out for this certificate.");

                }




        }
    }
}