A modern programming language that makes developers happier.

kotlinlang

:wave: Am I reading this right that I cannot pin to just root certificate, I have to pin to the whole chain in ktor?

<https://github.com/ktorio/ktor/blob/main/ktor-client/ktor-client-ios/darwin/src/io/ktor/client/engine/ios/certificates/CertificatePinner.kt>

No.

``` * If multiple patterns match a hostname, any match is sufficient. For example, suppose pin A
 * applies to `*.<http://publicobject.com|publicobject.com>` and pin B applies to `<http://api.publicobject.com|api.publicobject.com>`. Handshakes for
 * `<http://api.publicobject.com|api.publicobject.com>` are valid if either A's or B's certificate is in the chain.```

Also some good advice on Certificate pinning <https://developer.android.com/training/articles/security-ssl#Pinning>

<@U6Q90DDHR> thank you! Also in code: <https://github.com/ktorio/ktor/blob/40a055bcef7ad21ca0923607cb1ab45ccb638de2/ktor-client/ktor-client-ios/darwin/src/io/ktor/client/engine/ios/certificates/CertificatePinner.kt#L184>

but only in 1.5.2 onwards: <https://github.com/ktorio/ktor/pull/2302>

In &lt; 1.5.2 the whole chain has to match

I have concerns on framework code either having promoted opinions on how or whether to pin. I wish for a world where security team makes own educated decisions.