:wave: Am I reading this right that I cannot pin to just root certificate, I have to pin to the whol...

# ktor

[Nikolay Kasyanov]

👋 Am I reading this right that I cannot pin to just root certificate, I have to pin to the whole chain in ktor?

https://github.com/ktorio/ktor/blob/main/ktor-client/ktor-client-ios/darwin/src/io/ktor/client/engine/ios/certificates/CertificatePinner.kt

[yschimke]

No.

* If multiple patterns match a hostname, any match is sufficient. For example, suppose pin A
 * applies to `*.<http://publicobject.com|publicobject.com>` and pin B applies to `<http://api.publicobject.com|api.publicobject.com>`. Handshakes for
 * `<http://api.publicobject.com|api.publicobject.com>` are valid if either A's or B's certificate is in the chain.

[yschimke]

Also some good advice on Certificate pinning https://developer.android.com/training/articles/security-ssl#Pinning

[Nikolay Kasyanov]

@yschimke thank you! Also in code: https://github.com/ktorio/ktor/blob/40a055bcef7ad21ca0923607cb1ab45ccb638de2/ktor-client/ktor-client-ios/darwin/src/io/ktor/client/engine/ios/certificates/CertificatePinner.kt#L184

[Nikolay Kasyanov]

but only in 1.5.2 onwards: https://github.com/ktorio/ktor/pull/2302

[Nikolay Kasyanov]

In < 1.5.2 the whole chain has to match

[yschimke]

Ouch. That is terrible

[yschimke]

I have concerns on framework code either having promoted opinions on how or whether to pin. I wish for a world where security team makes own educated decisions.