同一请求中的 SSL 固定

Question

我的问题是，在每个 Get/Post 请求

之前，我是否必须单独请求检查 SSL Pinning

OkHttpClient client = new OkHttpClient.Builder().certificatePinner(
                new CertificatePinner.Builder()
                        .add(pinningUrl, "sha256/invalidPIN")
                        .build()).build();
Request request = new Request.Builder()
                .url(pinningUrl)
                .build();
Response response = client.newCall(request).execute();

或者我可以像这样Get/Post检查每个

CertificatePinner certificatePinner = new CertificatePinner.Builder()
                        .add(pinningUrl, "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")                    .build();
                OkHttpClient client = new OkHttpClient().newBuilder().certificatePinner(certificatePinner).build();
Request request = new Request.Builder()         .url(getResources().getString(R.string.server_url_user_mgmt_services))
                        .addHeader("Content-Type", "application).post(body)
                        .build();

                client.newCall(request)
                        .enqueue(new Callback() {

                            @Override
                            public void onFailure(Call call, IOException e) {
                                pd.dismiss();
                                Toast.makeText(LoginActivity.this, "Some error occured!\nTry Again", Toast.LENGTH_SHORT).show();
                            }

                            @Override
                            public void onResponse(Call call, Response response) throws IOException {
                                String str = response.body().toString();
                            }
                        });

如果我在每次请求时检查它，请求都会执行但它不会检查 certificate 帮我解决这个问题。

Answer 1

根据您的第一个代码示例，您似乎在尝试使用 URL 而不是主机名或通配符来固定。

您应该在您的 OkHttpClient 每个主机 上配置一次，然后就可以发出您的正常请求。您定义的引脚应该以主机为键，而不是 url.

https://square.github.io/okhttp/3.x/okhttp/okhttp3/CertificatePinner.html

 String hostname = "publicobject.com";
 CertificatePinner certificatePinner = new CertificatePinner.Builder()
     .add(hostname, "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
     .build();
 OkHttpClient client = OkHttpClient.Builder()
     .certificatePinner(certificatePinner)
     .build();

 Request request = new Request.Builder()
     .url("https://" + hostname)
     .build();
 client.newCall(request).execute();

同一请求中的 SSL 固定

SSL Pinning in same request

ssl

okhttp3