Additional trust anchors are only respected if build with -DDEBUG=1.
Otherwise the unsafe certificates will need to be in the OS trust store
(OSX Keychain or iOS General > About > Trust Store) to work.
@implementation TSKPinningValidator
++ (BOOL)allowsAdditionalTrustAnchors
+{
+ static const BOOL allowAdditionalTrustAnchors = {
+#if DEBUG == 1
+ YES
+#else
+ NO
+#endif
+ };
+ return allowAdditionalTrustAnchors;
+}
+
#pragma mark Instance Methods
- (instancetype _Nullable)initWithPinnedDomainConfig:(NSDictionary * _Nullable)pinnedDomains
else
{
// Add bundled trust anchors if specified in the configuration
+ if (self.class.allowsAdditionalTrustAnchors) {
NSArray *additionalTrustAnchors = domainConfig[kTSKAdditionalTrustAnchors];
if (additionalTrustAnchors.count)
{
+ TSKLog(@"Pin validation includes %ld potentially unsafe trust anchors", (long)additionalTrustAnchors.count);
SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)additionalTrustAnchors);
SecTrustSetAnchorCertificatesOnly(serverTrust, false); // trust union of OS and user anchor certificate sets
}
+ }
// The domain has a pinning policy that has not expired
// Look for one the configured public key pins in the server's evaluated certificate chain
domainConfig[kTSKPublicKeyHashes],
self.spkiHashCache);
- // Remove configured additional trust anchors
- if (additionalTrustAnchors.count)
- {
- // SecTrustSetAnchorCertificates is documented to restore default anchor
- // certs if NULL is passed as the second parameter, but that param is also
- // annotated as non-null, causing a warning and confusion...
- CFArrayRef nullArray = NULL;
- SecTrustSetAnchorCertificates(serverTrust, nullArray);
- }
-
if (validationResult == TSKPinValidationResultSuccess)
{
// Pin validation was successful
