Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using a pinned certificate will always incorrectly trust peer on iOS #184

Open
jakobjohansson opened this issue Dec 20, 2023 · 1 comment
Labels
bug Something isn't working

Comments

@jakobjohansson
Copy link

jakobjohansson commented Dec 20, 2023

Description

Due to a condition in didReceiveTrust combined with _checkValidity only being set locally, the trust evaluation will yield false positive results and exit early when using a pinned certificate.

This should potentially be a security risk if providing a certificate using the ca property since the library essentially skips certificate validation.

Steps to reproduce

Steps to reproduce the behavior:

  1. Connect to a server with connectTLS
  2. Use a pinned certificate that doesn't match the server certificate

Current behavior

The code exits early and connects without validating the certificate.

Expected behavior

The certificate should be validated and connection should be dropped.

@jakobjohansson jakobjohansson added the bug Something isn't working label Dec 20, 2023
@jakobjohansson
Copy link
Author

Bump @Rapsssito

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant