使用地图，播放服务，分析等功能的Android应用中的SSL证书固定

Question

Corresponding issue on github issue tracker

I have been doing a fair bit of reading about preventing man in the middle attacks on my app using tools like Charles, Fiddler, mitm etc. I liked the idea of pinning my server's SSL certificate since that means all other certs will throw an error which is what I want.

But, the app uses libs like google maps, play services, analytics tools etc which must be using their own SSL certs. Does it mean that I would need to manually pin the certs of all these libs too? What's the common way to deal with such a situation?

Answer 1

不，您不需要固定第三方库的证书，因为它们不使用配置了CertificatePinner的OkHttpClient实例。