title: How to prevent root device to bypass certificate pinning in Android?
body: <p>I am developing a project that require the Android app can prevent bypassing certificate pinning/trust a fake cert when doing network calling even in a rooted devices. </p>
  
  <p>So far I can make it when the device is not rooted. I just need to prevent some bypassing method like using JustTrustMe in Xposed framework.</p>
  
  <p>I am using retrofit and okHttp during network calling.</p>
  
  <p>I have tried the using CertPinner in okHttp and its version is 3.10.0
  and also tried to follow the code in android developer <a href="https://developer.android.com/training/articles/security-ssl#java" rel="nofollow noreferrer">https://developer.android.com/training/articles/security-ssl#java</a></p>
  
  <p>here is the sample code i have tried and copied from google</p>
  
  <pre><code>// Load CAs from an InputStream
  // (could be from a resource or ByteArrayInputStream or ...)
  CertificateFactory cf = CertificateFactory.getInstance("X.509");
  // From https://www.washington.edu/itconnect/security/ca/load-der.crt
  InputStream caInput = new BufferedInputStream(new FileInputStream("load-der.crt"));
  Certificate ca;
  try {
      ca = cf.generateCertificate(caInput);
      System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());
  } finally {
      caInput.close();
  }
  
  // Create a KeyStore containing our trusted CAs
  String keyStoreType = KeyStore.getDefaultType();
  KeyStore keyStore = KeyStore.getInstance(keyStoreType);
  keyStore.load(null, null);
  keyStore.setCertificateEntry("ca", ca);
  
  // Create a TrustManager that trusts the CAs in our KeyStore
  String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
  TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
  tmf.init(keyStore);
  
  // Create an SSLContext that uses our TrustManager
  SSLContext context = SSLContext.getInstance("TLS");
  context.init(null, tmf.getTrustManagers(), null);
  
  </code></pre>
  
  <p>And the cert pinning sample code</p>
  
  <pre><code>String hostname = "publicobject.com";
  CertificatePinner certificatePinner = new CertificatePinner.Builder()
      .add(hostname, "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
      .build();
  OkHttpClient client = OkHttpClient.Builder()
      .certificatePinner(certificatePinner)
      .build();
  
  Request request = new Request.Builder()
      .url("https://" + hostname)
      .build();
  client.newCall(request).execute();
  
  </code></pre>
  
  <p>Both are the simplest code but none of it working</p>
  
  <p>I would like to make it at least prevent some bypassing method like using JustTrustMe in Xposed framework/some easy automated bypassing method.</p>
  
  <p>May i know if it is possible to do it or not, I have also tried some libs like 
  <a href="https://github.com/moxie0/AndroidPinning" rel="nofollow noreferrer">https://github.com/moxie0/AndroidPinning</a> </p>
  
  <p>suggested by JustTrustMe </p>
  
  <p><a href="https://github.com/Fuzion24/JustTrustMe" rel="nofollow noreferrer">https://github.com/Fuzion24/JustTrustMe</a></p>