();
+ boolean trustedChain = false;
+ int i;
+
+ if (systemKeyStore.isTrustRoot(chain[0])) {
+ trustedChain = true;
+ }
+
+ cleanChain.add(chain[0]);
+
+ for (i = 1; i < chain.length; i++) {
+ if (systemKeyStore.isTrustRoot(chain[i])) {
+ trustedChain = true;
+ }
+
+ if (isValidLink(chain[i], chain[i - 1])) {
+ cleanChain.add(chain[i]);
+ } else {
+ break;
+ }
+ }
+
+ final X509Certificate trustRoot = systemKeyStore.getTrustRootFor(chain[i - 1]);
+
+ if (trustRoot != null) {
+ cleanChain.add(trustRoot);
+ trustedChain = true;
+ }
+
+ if (trustedChain) {
+ return cleanChain.toArray(new X509Certificate[cleanChain.size()]);
+ } else {
+ throw new CertificateException("Didn't find a trust anchor in chain cleanup!");
+ }
+ }
+
+ private static boolean isValidLink(X509Certificate parent, X509Certificate child) {
+ if (!parent.getSubjectX500Principal().equals(child.getIssuerX500Principal())) {
+ return false;
+ }
+
+ try {
+ child.verify(parent.getPublicKey());
+ } catch (GeneralSecurityException gse) {
+ return false;
+ }
+
+ return true;
+ }
+}
diff --git a/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/PinningSSLSocketFactory.java b/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/PinningSSLSocketFactory.java
new file mode 100644
index 000000000..c8a2dd3c1
--- /dev/null
+++ b/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/PinningSSLSocketFactory.java
@@ -0,0 +1,166 @@
+/**
+ * Copyright (C) 2011-2013 Moxie Marlinspike
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see .
+ */
+
+package org.thoughtcrime.ssl.pinning;
+
+import android.content.Context;
+
+import org.apache.http.conn.ssl.SSLSocketFactory;
+import org.apache.http.conn.ssl.X509HostnameVerifier;
+import org.apache.http.params.HttpConnectionParams;
+import org.apache.http.params.HttpParams;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.TrustManager;
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.Socket;
+import java.security.KeyManagementException;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+
+/**
+ * A standard Apache SSL Socket Factory that uses an pinning trust manager.
+ *
+ * To use:
+ *
+ *
+ * String[] pins = new String[] {"40c5401d6f8cbaf08b00edefb1ee87d005b3b9cd"};
+ * SchemeRegistry schemeRegistry = new SchemeRegistry();
+ * schemeRegistry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));
+ * schemeRegistry.register(new Scheme("https", new PinningSSLSocketFactory(getContext(),pins, 0), 443));
+ *
+ * HttpParams httpParams = new BasicHttpParams();
+ * ClientConnectionManager connectionManager = new ThreadSafeClientConnManager(httpParams, schemeRegistry);
+ * DefaultHttpClient httpClient = new DefaultHttpClient(connectionManager, httpParams);
+ *
+ * HttpResponse response = httpClient.execute(new HttpGet("https://www.google.com/"));
+ *
+ *
+ *
+ *
+ * @author Moxie Marlinspike
+ */
+public class PinningSSLSocketFactory extends SSLSocketFactory {
+
+ private final javax.net.ssl.SSLSocketFactory pinningSocketFactory;
+
+ /**
+ * Constructs a PinningSSLSocketFactory with a set of valid pins.
+ *
+ * @param pins An array of encoded pins to match a seen certificate
+ * chain against. A pin is a hex-encoded hash of a X.509 certificate's
+ * SubjectPublicKeyInfo. A pin can be generated using the provided pin.py
+ * script: python ./tools/pin.py certificate_file.pem
+ *
+ * @param enforceUntilTimestampMillis A timestamp (in milliseconds) when pins will stop being
+ * enforced. Normal non-pinned certificate validation
+ * will continue. Set this to some period after your build
+ * date, or to 0 to enforce pins forever.
+ */
+
+ public PinningSSLSocketFactory(Context context, String[] pins, long enforceUntilTimestampMillis)
+ throws UnrecoverableKeyException, KeyManagementException,
+ NoSuchAlgorithmException, KeyStoreException
+ {
+ super(null);
+
+ final SystemKeyStore keyStore = SystemKeyStore.getInstance(context);
+ final SSLContext pinningSslContext = SSLContext.getInstance(TLS);
+ final TrustManager[] pinningTrustManagers = initializePinningTrustManagers(keyStore, pins, enforceUntilTimestampMillis);
+
+ pinningSslContext.init(null, pinningTrustManagers, null);
+ this.pinningSocketFactory = pinningSslContext.getSocketFactory();
+ }
+
+ @Override
+ public Socket createSocket() throws IOException {
+ return pinningSocketFactory.createSocket();
+ }
+
+ @Override
+ public Socket connectSocket(final Socket sock, final String host, final int port,
+ final InetAddress localAddress, int localPort,
+ final HttpParams params) throws IOException {
+ final SSLSocket sslSock = (SSLSocket) ((sock != null) ? sock : createSocket());
+
+ if ((localAddress != null) || (localPort > 0)) {
+ if (localPort < 0) {
+ localPort = 0;
+ }
+
+ sslSock.bind(new InetSocketAddress(localAddress, localPort));
+ }
+
+ final int connTimeout = HttpConnectionParams.getConnectionTimeout(params);
+ final int soTimeout = HttpConnectionParams.getSoTimeout(params);
+
+ final InetSocketAddress remoteAddress = new InetSocketAddress(host, port);
+ sslSock.connect(remoteAddress, connTimeout);
+ sslSock.setSoTimeout(soTimeout);
+
+ try {
+ SSLSocketFactory.STRICT_HOSTNAME_VERIFIER.verify(host, sslSock);
+ } catch (IOException iox) {
+ try {
+ sslSock.close();
+ } catch (Exception ignored) {
+ }
+ throw iox;
+ }
+
+ return sslSock;
+ }
+
+ @Override
+ public Socket createSocket(final Socket socket, final String host,
+ int port, final boolean autoClose)
+ throws IOException
+ {
+ if (port == -1) {
+ port = 443;
+ }
+
+ final SSLSocket sslSocket = (SSLSocket) pinningSocketFactory.createSocket(socket, host, port, autoClose);
+ SSLSocketFactory.STRICT_HOSTNAME_VERIFIER.verify(host, sslSocket);
+ return sslSocket;
+ }
+
+ @Override
+ public void setHostnameVerifier(X509HostnameVerifier hostnameVerifier) {
+ throw new IllegalArgumentException("Only strict hostname verification (default) " +
+ "is supported!");
+ }
+
+ @Override
+ public X509HostnameVerifier getHostnameVerifier() {
+ return SSLSocketFactory.STRICT_HOSTNAME_VERIFIER;
+ }
+
+ private TrustManager[] initializePinningTrustManagers(SystemKeyStore keyStore,
+ String[] pins,
+ long enforceUntilTimestampMillis)
+ {
+ final TrustManager[] trustManagers = new TrustManager[1];
+ trustManagers[0] = new PinningTrustManager(keyStore, pins, enforceUntilTimestampMillis);
+
+ return trustManagers;
+ }
+}
diff --git a/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/PinningTrustManager.java b/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/PinningTrustManager.java
new file mode 100644
index 000000000..7e19ca86b
--- /dev/null
+++ b/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/PinningTrustManager.java
@@ -0,0 +1,199 @@
+/**
+ * Copyright (C) 2011-2013 Moxie Marlinspike
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see .
+ */
+
+package org.thoughtcrime.ssl.pinning;
+
+import android.util.Log;
+
+import java.security.KeyStoreException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Set;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509TrustManager;
+
+/**
+ * A TrustManager implementation that enforces Certificate "pins."
+ *
+ *
+ * PinningTrustManager is layered on top of the system's default TrustManager,
+ * such that the system continues to validate CA signatures for SSL connections
+ * as usual. Additionally, however, PinningTrustManager will enforce certificate
+ * constraints on the validated certificate chain. Specifically, it
+ * will ensure that one of an arbitrary number of specified SubjectPublicKeyInfos
+ * appears somewhere in the valid certificate chain.
+ *
+ *
+ * To use:
+ *
+ * TrustManager[] trustManagers = new TrustManager[1];
+ * trustManagers[0] = new PinningTrustManager(SystemKeyStore.getInstance(),
+ * new String[] {"f30012bbc18c231ac1a44b788e410ce754182513"},
+ * 0);
+ *
+ * SSLContext sslContext = SSLContext.getInstance("TLS");
+ * sslContext.init(null, trustManagers, null);
+ *
+ * HttpsURLConnection urlConnection = (HttpsURLConnection)new URL("https://encrypted.google.com/").openConnection();
+ * urlConnection.setSSLSocketFactory(sslContext.getSocketFactory());
+ * InputStream in = urlConnection.getInputStream();
+ *
+ *
+ *
+ * @author Moxie Marlinspike
+ */
+public class PinningTrustManager implements X509TrustManager {
+
+ private final TrustManager[] systemTrustManagers;
+ private final SystemKeyStore systemKeyStore;
+ private final long enforceUntilTimestampMillis;
+
+ private final List pins = new LinkedList();
+ private final Set cache = Collections.synchronizedSet(new HashSet());
+
+ /**
+ * Constructs a PinningTrustManager with a set of valid pins.
+ *
+ * @param keyStore A SystemKeyStore that validation will be based on.
+ *
+ * @param pins An array of encoded pins to match a seen certificate
+ * chain against. A pin is a hex-encoded hash of a X.509 certificate's
+ * SubjectPublicKeyInfo. A pin can be generated using the provided pin.py
+ * script: python ./tools/pin.py certificate_file.pem
+ *
+ * @param enforceUntilTimestampMillis A timestamp (in milliseconds) when pins will stop being
+ * enforced. Normal non-pinned certificate validation
+ * will continue. Set this to some period after your build
+ * date, or to 0 to enforce pins forever.
+ */
+ public PinningTrustManager(SystemKeyStore keyStore, String[] pins, long enforceUntilTimestampMillis) {
+ this.systemTrustManagers = initializeSystemTrustManagers(keyStore);
+ this.systemKeyStore = keyStore;
+ this.enforceUntilTimestampMillis = enforceUntilTimestampMillis;
+
+ for (String pin : pins) {
+ this.pins.add(hexStringToByteArray(pin));
+ }
+ }
+
+ private TrustManager[] initializeSystemTrustManagers(SystemKeyStore keyStore) {
+ try {
+ final TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509");
+ tmf.init(keyStore.trustStore);
+
+ return tmf.getTrustManagers();
+ } catch (NoSuchAlgorithmException nsae) {
+ throw new AssertionError(nsae);
+ } catch (KeyStoreException e) {
+ throw new AssertionError(e);
+ }
+ }
+
+ private boolean isValidPin(X509Certificate certificate) throws CertificateException {
+ try {
+ final MessageDigest digest = MessageDigest.getInstance("SHA1");
+ final byte[] spki = certificate.getPublicKey().getEncoded();
+ final byte[] pin = digest.digest(spki);
+
+ for (byte[] validPin : this.pins) {
+ if (Arrays.equals(validPin, pin)) {
+ return true;
+ }
+ }
+
+ return false;
+ } catch (NoSuchAlgorithmException nsae) {
+ throw new CertificateException(nsae);
+ }
+ }
+
+ private void checkSystemTrust(X509Certificate[] chain, String authType)
+ throws CertificateException {
+ for (TrustManager systemTrustManager : systemTrustManagers) {
+ ((X509TrustManager) systemTrustManager).checkServerTrusted(chain, authType);
+ }
+ }
+
+ private void checkPinTrust(X509Certificate[] chain)
+ throws CertificateException {
+
+ if (enforceUntilTimestampMillis != 0 &&
+ System.currentTimeMillis() > enforceUntilTimestampMillis)
+ {
+ Log.w("PinningTrustManager", "Certificate pins are stale, falling back to system trust.");
+ return;
+ }
+
+ final X509Certificate[] cleanChain = CertificateChainCleaner.getCleanChain(chain, systemKeyStore);
+
+ for (X509Certificate certificate : cleanChain) {
+ if (isValidPin(certificate)) {
+ return;
+ }
+ }
+
+ throw new CertificateException("No valid pins found in chain!");
+ }
+
+ public void checkClientTrusted(X509Certificate[] chain, String authType)
+ throws CertificateException {
+ throw new CertificateException("Client certificates not supported!");
+ }
+
+ public void checkServerTrusted(X509Certificate[] chain, String authType)
+ throws CertificateException
+ {
+ if (cache.contains(chain[0])) {
+ return;
+ }
+
+ // Note: We do this so that we'll never be doing worse than the default
+ // system validation. It's duplicate work, however, and can be factored
+ // out if we make the verification below more complete.
+ checkSystemTrust(chain, authType);
+ checkPinTrust(chain);
+ cache.add(chain[0]);
+ }
+
+ public X509Certificate[] getAcceptedIssuers() {
+ return null;
+ }
+
+ private byte[] hexStringToByteArray(String s) {
+ final int len = s.length();
+ final byte[] data = new byte[len / 2];
+
+ for (int i = 0; i < len; i += 2) {
+ data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4) +
+ Character.digit(s.charAt(i + 1), 16));
+ }
+
+ return data;
+ }
+
+ public void clearCache() {
+ cache.clear();
+ }
+}
diff --git a/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/SystemKeyStore.java b/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/SystemKeyStore.java
new file mode 100644
index 000000000..3c013b5de
--- /dev/null
+++ b/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/SystemKeyStore.java
@@ -0,0 +1,138 @@
+/**
+ * Copyright (C) 2011-2013 Moxie Marlinspike
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see .
+ */
+package org.thoughtcrime.ssl.pinning;
+
+import android.content.Context;
+import android.content.res.Resources.NotFoundException;
+import android.util.Log;
+
+import java.io.BufferedInputStream;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.Principal;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Enumeration;
+import java.util.HashMap;
+
+/**
+ * An interface to the system's trust anchors. We're using our
+ * own truststore, which is just the AOSP default, but in a place
+ * we know to find it for sure.
+ *
+ * @author Moxie Marlinspike
+ */
+public class SystemKeyStore {
+ private static final int CACERTS_FILE_SIZE = 1024 * 140;
+
+ private static SystemKeyStore instance;
+
+ public static synchronized SystemKeyStore getInstance(Context context) {
+ if (instance == null) {
+ instance = new SystemKeyStore(context);
+ }
+ return instance;
+ }
+
+ private final HashMap trustRoots;
+ final KeyStore trustStore;
+
+ private SystemKeyStore(Context context) {
+ final KeyStore trustStore = getTrustStore(context);
+ this.trustRoots = initializeTrustedRoots(trustStore);
+ this.trustStore = trustStore;
+ }
+
+ public boolean isTrustRoot(X509Certificate certificate) {
+ final X509Certificate trustRoot = trustRoots.get(certificate.getSubjectX500Principal());
+ return trustRoot != null && trustRoot.getPublicKey().equals(certificate.getPublicKey());
+ }
+
+ public X509Certificate getTrustRootFor(X509Certificate certificate) {
+ final X509Certificate trustRoot = trustRoots.get(certificate.getIssuerX500Principal());
+
+ if (trustRoot == null) {
+ return null;
+ }
+
+ if (trustRoot.getSubjectX500Principal().equals(certificate.getSubjectX500Principal())) {
+ return null;
+ }
+
+ try {
+ certificate.verify(trustRoot.getPublicKey());
+ } catch (GeneralSecurityException e) {
+ return null;
+ }
+
+ return trustRoot;
+ }
+
+ private HashMap initializeTrustedRoots(KeyStore trustStore) {
+ try {
+ final HashMap trusted =
+ new HashMap();
+
+ for (Enumeration aliases = trustStore.aliases(); aliases.hasMoreElements(); ) {
+ final String alias = aliases.nextElement();
+ final X509Certificate cert = (X509Certificate) trustStore.getCertificate(alias);
+
+ if (cert != null) {
+ trusted.put(cert.getSubjectX500Principal(), cert);
+ }
+ }
+
+ return trusted;
+ } catch (KeyStoreException e) {
+ throw new AssertionError(e);
+ }
+ }
+
+ private KeyStore getTrustStore(Context context) {
+ try {
+ final KeyStore trustStore = KeyStore.getInstance("BKS");
+ final BufferedInputStream bin =
+ new BufferedInputStream(context.getResources().openRawResource(R.raw.cacerts),
+ CACERTS_FILE_SIZE);
+
+ try {
+ trustStore.load(bin, "changeit".toCharArray());
+ } finally {
+ try {
+ bin.close();
+ } catch (IOException ioe) {
+ Log.w("SystemKeyStore", ioe);
+ }
+ }
+
+ return trustStore;
+ } catch (KeyStoreException kse) {
+ throw new AssertionError(kse);
+ } catch (NoSuchAlgorithmException e) {
+ throw new AssertionError(e);
+ } catch (CertificateException e) {
+ throw new AssertionError(e);
+ } catch (NotFoundException e) {
+ throw new AssertionError(e);
+ } catch (IOException e) {
+ throw new AssertionError(e);
+ }
+ }
+}
diff --git a/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/util/PinningHelper.java b/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/util/PinningHelper.java
new file mode 100644
index 000000000..10135eb26
--- /dev/null
+++ b/extern/AndroidPinning/src/org/thoughtcrime/ssl/pinning/util/PinningHelper.java
@@ -0,0 +1,111 @@
+/**
+ * Copyright (C) 2011-2013 Moxie Marlinspike
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see .
+ */
+
+package org.thoughtcrime.ssl.pinning.util;
+
+import android.content.Context;
+
+import org.apache.http.client.HttpClient;
+import org.apache.http.conn.ClientConnectionManager;
+import org.apache.http.conn.scheme.PlainSocketFactory;
+import org.apache.http.conn.scheme.Scheme;
+import org.apache.http.conn.scheme.SchemeRegistry;
+import org.apache.http.impl.client.DefaultHttpClient;
+import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager;
+import org.apache.http.params.BasicHttpParams;
+import org.apache.http.params.HttpParams;
+import org.thoughtcrime.ssl.pinning.PinningSSLSocketFactory;
+import org.thoughtcrime.ssl.pinning.PinningTrustManager;
+import org.thoughtcrime.ssl.pinning.SystemKeyStore;
+
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
+import java.io.IOException;
+import java.net.URL;
+import java.security.KeyManagementException;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+
+public class PinningHelper {
+
+ /**
+ * Constructs an HttpClient that will validate SSL connections with a PinningTrustManager.
+ *
+ * @param pins An array of encoded pins to match a seen certificate
+ * chain against. A pin is a hex-encoded hash of a X.509 certificate's
+ * SubjectPublicKeyInfo. A pin can be generated using the provided pin.py
+ * script: python ./tools/pin.py certificate_file.pem
+ */
+
+ public static HttpClient getPinnedHttpClient(Context context, String[] pins) {
+ try {
+ SchemeRegistry schemeRegistry = new SchemeRegistry();
+ schemeRegistry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));
+ schemeRegistry.register(new Scheme("https", new PinningSSLSocketFactory(context, pins, 0), 443));
+
+ HttpParams httpParams = new BasicHttpParams();
+ ClientConnectionManager connectionManager = new ThreadSafeClientConnManager(httpParams, schemeRegistry);
+ return new DefaultHttpClient(connectionManager, httpParams);
+ } catch (UnrecoverableKeyException e) {
+ throw new AssertionError(e);
+ } catch (KeyManagementException e) {
+ throw new AssertionError(e);
+ } catch (NoSuchAlgorithmException e) {
+ throw new AssertionError(e);
+ } catch (KeyStoreException e) {
+ throw new AssertionError(e);
+ }
+ }
+
+ /**
+ * Constructs an HttpsURLConnection that will validate HTTPS connections against a set of
+ * specified pins.
+ *
+ * @param pins An array of encoded pins to match a seen certificate
+ * chain against. A pin is a hex-encoded hash of a X.509 certificate's
+ * SubjectPublicKeyInfo. A pin can be generated using the provided pin.py
+ * script: python ./tools/pin.py certificate_file.pem
+ *
+ */
+
+ public static HttpsURLConnection getPinnedHttpsURLConnection(Context context, String[] pins, URL url)
+ throws IOException
+ {
+ try {
+ if (!url.getProtocol().equals("https")) {
+ throw new IllegalArgumentException("Attempt to construct pinned non-https connection!");
+ }
+
+ TrustManager[] trustManagers = new TrustManager[1];
+ trustManagers[0] = new PinningTrustManager(SystemKeyStore.getInstance(context), pins, 0);
+
+ SSLContext sslContext = SSLContext.getInstance("TLS");
+ sslContext.init(null, trustManagers, null);
+
+ HttpsURLConnection urlConnection = (HttpsURLConnection)url.openConnection();
+ urlConnection.setSSLSocketFactory(sslContext.getSocketFactory());
+
+ return urlConnection;
+ } catch (NoSuchAlgorithmException nsae) {
+ throw new AssertionError(nsae);
+ } catch (KeyManagementException e) {
+ throw new AssertionError(e);
+ }
+ }
+}