https://github.com/jonathanpeppers/xamarin.sslpinning
Test project to setup SSL pinning with Xamarin.iOS
https://github.com/jonathanpeppers/xamarin.sslpinning
nsurlsession ssl ssl-pinning xamarin xamarin-ios
Last synced: about 2 months ago
JSON representation
Test project to setup SSL pinning with Xamarin.iOS
- Host: GitHub
- URL: https://github.com/jonathanpeppers/xamarin.sslpinning
- Owner: jonathanpeppers
- License: mit
- Created: 2017-02-05T02:30:07.000Z (over 8 years ago)
- Default Branch: master
- Last Pushed: 2017-02-16T22:35:00.000Z (over 8 years ago)
- Last Synced: 2025-03-19T05:33:01.296Z (2 months ago)
- Topics: nsurlsession, ssl, ssl-pinning, xamarin, xamarin-ios
- Language: C#
- Homepage:
- Size: 30.3 KB
- Stars: 15
- Watchers: 2
- Forks: 2
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Xamarin.SSLPinning
Test project to setup SSL pinning with Xamarin
Looking for a workaround for blog post [here](https://thomasbandt.com/certificate-and-public-key-pinning-with-xamarin)
Basically I did the following to get this to work:
- Dumped Xamarin's source for `NSUrlSessionHandler.cs` and its code in `HttpClientEx.cs`
- Figured out a quick command to export certificate
- Wrote some C# code ported from Obj-C [here](https://gist.github.com/edwardmp/df8517aa9f1752e73353)
My code:
```csharp
var serverCertChain = challenge.ProtectionSpace.ServerSecTrust;
var first = serverCertChain[0].DerData;
var cert = NSData.FromFile("httpbin.cer");
if (first.IsEqual(cert))
{
completionHandler(NSUrlSessionAuthChallengeDisposition.PerformDefaultHandling, challenge.ProposedCredential);
}
else
{
completionHandler(NSUrlSessionAuthChallengeDisposition.RejectProtectionSpace, null);
}
```
*NOTE: you may want to do some checks for empty array & reuse NSData for better performance*
*MORE NOTE: I would not ship the public key as a flat file in your app, place it somewhere safe inside an assembly so an attacker will not easily replace it with their own*
If you need to get the cert for your own site, run the command:
```
openssl s_client -connect httpbin.org:443 | openssl x509 -outform DER > httpbin.cer
```
Replace `httpbin` with your domain.
If Xamarin could somehow expose `DidReceiveChallenge` that would be awesome!