Retrofit2 和证书固定

Question

In my android app I want to use certificate pinning when communicating with the server. I saw this code that uses the keystore that is stored in the raw folder.

OkClient client = new RetrofitClientBuilder()
.pinCertificates(getResources(), R.raw.keystore, STORE_PASS)
.build()

I'm using retrofit2 and OkHTTP3 and just saw this example:

 OkHttpClient client = new OkHttpClient.Builder()
    .certificatePinner(new CertificatePinner.Builder()
            .add("publicobject.com", "sha1/DmxUShsZuNiqPQsX2Oi9uv2sCnw=")
            .add("publicobject.com", "sha1/SXxoaOSEzPC6BgGmxAt/EAcsajw=")
            .add("publicobject.com", "sha1/blhOM3W9V/bVQhsWAcLYwPU6n24=")
            .add("publicobject.com", "sha1/T5x9IXmcrQ7YuQxXnxoCmeeQ84c=")
            .build())
    .build();

Retrofit retrofit = new Retrofit.Builder()
    .baseUrl("http://api.nuuneoi.com/base/")
    .addConverterFactory(GsonConverterFactory.create())
    .client(client)
    .build();

Does this later approach achieves the same result has the first one?

Answer 1

I can say that this approach worked wonderfully for me. Just make sure you add your endpoint correctly without the "https://" to the certificate pinner and it should work just fine.

Answer 2

您应该需要将sha1/更改为sha256/ ，它对我来说效果很好。