{"id":13608409,"url":"https://github.com/appmattus/certificatetransparency","last_synced_at":"2025-04-10T01:09:20.253Z","repository":{"id":37943076,"uuid":"319979095","full_name":"appmattus/certificatetransparency","owner":"appmattus","description":"Certificate transparency for Android and JVM","archived":false,"fork":false,"pushed_at":"2025-04-09T15:29:40.000Z","size":5418,"stargazers_count":158,"open_issues_count":12,"forks_count":29,"subscribers_count":13,"default_branch":"main","last_synced_at":"2025-04-10T01:08:53.448Z","etag":null,"topics":["android","certificate-transparency","hacktoberfest","java","kotlin","security","ssl"],"latest_commit_sha":null,"homepage":"","language":"Kotlin","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/appmattus.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE.md","code_of_conduct":"code-of-conduct.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null},"funding":{"github":["mattmook"],"patreon":null,"open_collective":null,"ko_fi":null,"tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"custom":null}},"created_at":"2020-12-09T14:19:18.000Z","updated_at":"2025-04-09T14:18:25.000Z","dependencies_parsed_at":"2023-12-20T15:46:08.381Z","dependency_job_id":null,"html_url":"https://github.com/appmattus/certificatetransparency","commit_stats":null,"previous_names":[],"tags_count":57,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appmattus%2Fcertificatetransparency","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appmattus%2Fcertificatetransparency/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appmattus%2Fcertificatetransparency/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appmattus%2Fcertificatetransparency/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/appmattus","download_url":"https://codeload.github.com/appmattus/certificatetransparency/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248137886,"owners_count":21053775,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","certificate-transparency","hacktoberfest","java","kotlin","security","ssl"],"created_at":"2024-08-01T19:01:27.054Z","updated_at":"2025-04-10T01:09:20.235Z","avatar_url":"https://github.com/appmattus.png","language":"Kotlin","funding_links":["https://github.com/sponsors/mattmook"],"categories":["Kotlin"],"sub_categories":[],"readme":"# Certificate transparency for Android and JVM\n\n[![CI status](https://github.com/appmattus/certificatetransparency/actions/workflows/main.yml/badge.svg)](https://github.com/appmattus/certificatetransparency/actions)\n[![codecov](https://codecov.io/gh/appmattus/certificatetransparency/branch/main/graph/badge.svg)](https://codecov.io/gh/appmattus/certificatetransparency)\n[![Maven Central](https://img.shields.io/maven-central/v/com.appmattus.certificatetransparency/certificatetransparency)](https://central.sonatype.com/search?q=com.appmattus.certificatetransparency)\n[![Snyk](https://snyk.io/test/github/appmattus/certificatetransparency/badge.svg)](https://security.snyk.io/package/maven/com.appmattus.certificatetransparency%3Acertificatetransparency)\n\nTo protect our apps from man-in-the-middle attacks one of the first things that\nusually springs to mind is certificate pinning. However, the issues of\ncertificate pinning are numerous. Firstly deciding on a reliable set of keys to\npin against is tough. Once you made that decision if your expectations don't\nmatch reality your users suffer from not being able to access your app or\nwebsite. Smashing Magazine learnt about this the hard way in late 2016 when they\nblocked users access for up to a year because of a mismatch between the pins and\nthe certificates. On mobile fixing an invalid pin means pushing out a new\nversion of an app which can still take a while to reach every user.\n\nSo with certificate pinning falling out of favour, what should you do? The new\nkid in town is **[certificate transparency](docs/what-is-certificate-transparency.md)**.\n\n## Security\n\nWe are open about the security of our library and provide a threat model in the\n[source code](ThreatDragonModels/), created using\n[OWASP Threat Dragon](https://threatdragon.org). If you feel there is something\nwe have missed please reach out so we can keep this up to date.\n\nThe source code and dependencies are continuously scanned with\n[Snyk](https://snyk.io), [CodeQL](https://codeql.github.com) and [mobsfscan](https://github.com/MobSF/mobsfscan).\n\n## Getting started\n\n[![Maven Central](https://img.shields.io/maven-central/v/com.appmattus.certificatetransparency/certificatetransparency)](https://central.sonatype.com/search?q=com.appmattus.certificatetransparency)\n\nFor Android modules include the `android` dependency in your build.gradle file\nwhich ensures the necessary ProGuard rules are present:\n\n```kotlin\nimplementation(\"com.appmattus.certificatetransparency:certificatetransparency-android:\u003clatest-version\u003e\")\n```\n\n\u003e :warning: The library uses Java 8+ language features and requires [Desugaring](https://developer.android.com/studio/write/java8-support#library-desugaring)\n\u003e to be enabled to run on Android 7 (API 25) or less.\n\nFor Java library modules include the dependency as follows:\n\n```kotlin\nimplementation(\"com.appmattus.certificatetransparency:certificatetransparency:\u003clatest-version\u003e\")\n```\n\nOn Android it is recommended to configure certificate transparency through the\nprovided [Java Security Provider](https://docs.oracle.com/javase/8/docs/api/java/security/Provider.html)\nat app startup, which can be configured through\n`installCertificateTransparencyProvider`. The advantage of this setup is it\nshould work across all network types including WebViews with no additional\nsetup.\n\n\u003e :warning: Android's WebViews only allow you to override GET network requests\n\u003e through overriding the *shouldInterceptRequest* method. This means the only\n\u003e reliable way to implement certificate transparency in WebViews is to use the\n\u003e Java Security Provider documented here. However, if you are using WebViews on\n\u003e Android 6.0 (API 23) or lower then `installCertificateTransparencyProvider`\n\u003e will cause [issues](https://github.com/appmattus/certificatetransparency/issues/51)\n\u003e and should be avoided.\n\n```kotlin\nclass SampleApplication : Application() {\n    override fun onCreate() {\n        super.onCreate()\n\n        installCertificateTransparencyProvider {\n            // Setup a logger\n            // NOTE: The logger outputs the host name and certificate\n            // transparency results which could be considered sensitive data.\n            // Please ensure you review your usage.\n            logger = BasicAndroidCTLogger(BuildConfig.DEBUG)\n\n            // Setup disk cache\n            diskCache = AndroidDiskCache(applicationContext)\n\n            // Exclude any subdomain but not \"appmattus.com\" with no subdomain\n            -\"*.appmattus.com\"\n\n            // Exclude specified domain\n            -\"example.com\"\n\n            // Override the exclusion by including a specific subdomain\n            +\"allowed.appmattus.com\"\n        }\n    }\n}\n```\n\nTake a look at the [advanced configuration](docs/advanced-configuration.md) for\ndocumentation on all the available options and [Using Certificate Transparency in SDKs](docs/using-certificate-transparency-in-sdks.md)\nfor guidance on usage in SDKs especially when using the Java Security Provider.\n\n\u003e :warning: Using the Java Security Provider may not work on all JVMs so if you\n\u003e are not on Android you are recommended to use one of the alternatives\n\u003e documented below.\n\nCertificate transparency can also be setup in specific network connections,\ninstructions are available for:\n\n- [OkHttp](docs/okhttp.md)\n- [Retrofit](docs/retrofit.md)\n- [HttpURLConnection](docs/httpurlconnection.md)\n- [Volley](docs/volley.md)\n- [X509TrustManager](docs/x509trustmanager.md) If you are dealing with non-HTTPS\n  connections you can also use the library to verify the certificates by\n  wrapping a X509TrustManager and using that.\n\nCurrently, there is no support in the library for [Apache HttpClient](https://hc.apache.org/httpcomponents-client-5.1.x/).\n\n## Certificate revocation\n\nUnfortunately in Android there is no built-in support for certificate\nrevocation, which means you're basically on your own. This is an incredibly hard\nto solve problem and it is worth reading [revocation is broken](https://scotthelme.co.uk/revocation-is-broken/)\nfor more background. Needless to say I would argue that revocation is flawed\nalong with the broken implementations in mobile and web browsers.\n\nFor our purposes we've added `certificateRevocationInterceptor` to this library:\n\n```kotlin\ncertificateRevocationInterceptor {\n    addCrl(\n        issuerDistinguishedName = \"ME0xCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIgU2VjdXJlIFNlcnZlciBDQQ==\",\n        serialNumbers = listOf(\"Aa8e+91erglSMgsk/mtVaA==\", \"A3G1iob2zpw+y3v0L5II/A==\")\n    )\n}\n```\n\nIt is worth highlighting that the list of revoked certificates would need to be\nbuilt into the app and so would require pushing out an app update should you\nwant to add a revocation in. This does mean there's a small window for any\nattacks using a revoked certificate.\n\n## Contributing\n\nPlease read [CONTRIBUTING.md](CONTRIBUTING.md) for details on our code of\nconduct, and the process for submitting pull requests to us.\n\n## Versioning\n\nWe use [SemVer](http://semver.org/) for versioning. For the versions available,\nsee the [tags on this repository](https://github.com/appmattus/certificatetransparency/tags).\n\n## License\n\n[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE.md)\n\nThis project is licensed under the Apache License, Version 2.0 - see the\n[LICENSE.md](LICENSE.md) file for details\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fappmattus%2Fcertificatetransparency","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fappmattus%2Fcertificatetransparency","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fappmattus%2Fcertificatetransparency/lists"}