android - Android 版 OkHttp : Option to NOT enforce Certificate/public key pinning

Question

我在我的 SDK 中使用 Okhttp + Retrofit 进行联网。我需要实现证书固定但不强制执行。我们只需要获取固定失败的失败报告，并希望在监视期间暂时通过请求。

TrustKit 是另一个证书固定库，它提供此选项来设置 enforce = false。这样，请求本身就不会失败，但我们可以获得失败报告。

我没有看到使用 Okhttp CertificatePinner 实现类似行为的方法。如果证书固定失败，OkHttp 将始终使请求失败并出现异常。

关于如何使用现有功能实现此行为，您有什么建议吗？

如果我们可以扩展 CertificatePinner 类并覆盖 check() 会更容易吗？

提前致谢。

Answer 1

部分源自您对问题跟踪器的回答

package okhttp3

import javax.net.ssl.SSLPeerUnverifiedException

fun main() {
  class LoggingCertificatePinnerInterceptor(val certificatePinner: CertificatePinner) : Interceptor {
    override fun intercept(chain: Interceptor.Chain): Response {
      val host = chain.request().url.host
      val certs = chain.connection()
          ?.handshake()?.peerCertificates.orEmpty()

      try {
        certificatePinner.check(host, certs)
      } catch (e: SSLPeerUnverifiedException) {
        e.printStackTrace()
      }
      return chain.proceed(chain.request())
    }
  }

  val certificatePinner = CertificatePinner.Builder()
      .add("graph.facebook.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
      .build()
  val client = OkHttpClient.Builder()
      .addNetworkInterceptor(LoggingCertificatePinnerInterceptor(certificatePinner))
      .build()

  val request = Request.Builder()
      .url("https://graph.facebook.com/robots.txt")
      .build()
  val response = client.newCall(request)
      .execute()

  println(response.code)
}

javax.net.ssl.SSLPeerUnverifiedException: Certificate pinning failure!
  Peer certificate chain:
    sha256/KVFbweB8Ag9f08MZWU7m7cG83tpv8Ml39JpOHU3ESMg=: CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US
    sha256/k2v657xBsOVe1PQRwOsHsw3bsGT2VzIqz5K+59sNQws=: CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US
    sha256/WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18=: CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US
  Pinned certificates for graph.facebook.com:
    sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
    at okhttp3.CertificatePinner.check$okhttp(CertificatePinner.kt:199)
    at okhttp3.CertificatePinner.check(CertificatePinner.kt:149)
    at okhttp3.XxXKt$main$LoggingCertificatePinnerInterceptor.intercept(XxX.kt:13)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:100)
    at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:34)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:100)
    at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:82)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:100)
    at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:100)
    at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:76)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:100)
    at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:197)
    at okhttp3.internal.connection.RealCall.execute(RealCall.kt:148)
    at okhttp3.XxXKt.main(XxX.kt:32)
    at okhttp3.XxXKt.main(XxX.kt)
200