Search code examples
androidokhttppinningcertificate-pinning

SHA-256 certificate pinning isn't working

I have a strange problem with certificate pinning.

If I use network-security-config xml with raw certificate it works. But if I switch to sha256 pinning in the same file, it doesn't work o_O

enter image description here

I checked 10 times whether I'm using a correct sha256. Even okhttp certificate pinner (from which I'm migrating to the network-security-config xml) shows me the same sha256, so it's 100% correct.

enter image description here

Does anybody know what is going on? :)

Solution

  • From your first answer it is likely your certificate isn't supported by the default root CAs. Test on ssllabs.com/ssltest and see what it says for Android.

    As you confirmed, the server isn't sending a complete chain to the root, so the missing intermediate is causing a failure. Some other clients will download the missing cert in this case, but not Android.