SSL Certificate pinning in Android app that uses maps, play services, analytics etc

Question

Corresponding issue on github issue tracker

I have been doing a fair bit of reading about preventing man in the middle attacks on my app using tools like Charles, Fiddler, mitm etc. I liked the idea of pinning my server's SSL certificate since that means all other certs will throw an error which is what I want.

But, the app uses libs like google maps, play services, analytics tools etc which must be using their own SSL certs. Does it mean that I would need to manually pin the certs of all these libs too? What's the common way to deal with such a situation?

Answer 1

不，您不需要固定第三方库的证书，因为它们不使用配置了CertificatePinner的OkHttpClient实例。