cthrace/open-keychain
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pin keybase certificate

Browse Source
This commit is contained in:
Dominik Schürmann
2015-09-21 14:05:44 +02:00
parent ad2c8867e6
commit 9ee61dc0df
4 changed files with 57 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
OpenKeychain/src/main/java/org/sufficientlysecure/keychain/KeychainApplication.java
View File

@@ -100,6 +100,12 @@ public class KeychainApplication extends Application {
TlsHelper.addPinnedCertificate("hkps.pool.sks-keyservers.net", getAssets(), "hkps.pool.sks-keyservers.net.CA.cer");
TlsHelper.addPinnedCertificate("pgp.mit.edu", getAssets(), "pgp.mit.edu.cer");
// NOTE:
// keybase.io.CA.cer only holds the CA issuing the actual keybase.io certificate, but this
// is better than no pinning!
// We are not using https://github.com/keybase/node-client/blob/master/src/ca.iced
// because it is only valid for api.keybase.io (https://github.com/keybase/keybase-issues/issues/964)
TlsHelper.addPinnedCertificate("keybase.io", getAssets(), "keybase.io.CA.cer");
TemporaryStorageProvider.cleanUp(this);