title: Certificate pinning in Android
body: <p>I am trying to learn how to do certificate pinning in an Android application. I found the tutorial <a href="http://www.thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but-your-app-ha/" rel="noreferrer">here</a>. I wanted to clarify I doubt I have based on my testing this code. </p>
  
  <p>I used the code as follows :</p>
  
  <pre><code>public class CertificatePinning {
  
    static SSLSocketFactory constructSSLSocketFactory(Context context) {
  
      SSLSocketFactory sslSocketFactory = null;
  
      try {
          AssetManager assetManager = context.getAssets();
          InputStream keyStoreInputStream = assetManager.open("myapp.store");
          KeyStore trustStore = KeyStore.getInstance("BKS");
  
          trustStore.load(keyStoreInputStream, "somepass".toCharArray());
  
          sslSocketFactory = new SSLSocketFactory(trustStore);
          sslSocketFactory.setHostnameVerifier(SSLSocketFactory.STRICT_HOSTNAME_VERIFIER);
      }
      catch(Exception e){
  
          Log.d("Exception", e.getLocalizedMessage());
      }
  
      return sslSocketFactory;
  }
  
  public static HttpClient getNewHttpClient(Context context) {
  
      DefaultHttpClient httpClient = null;
  
      try {
  
          SSLSocketFactory sslSocketFactory = constructSSLSocketFactory(context);
  
          HttpParams params = new BasicHttpParams();
          HttpProtocolParams.setVersion(params, HttpVersion.HTTP_1_1);
          HttpProtocolParams.setContentCharset(params, HTTP.UTF_8);
  
          SchemeRegistry registry = new SchemeRegistry();
          registry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));
          registry.register(new Scheme("https", sslSocketFactory, 443));
  
          ClientConnectionManager ccm = new ThreadSafeClientConnManager(params, registry);
  
          httpClient = new DefaultHttpClient(ccm, params);
  
      } catch (Exception e) {
  
          Log.d("Exception", e.getLocalizedMessage() );
  
          return null;
      }
  
      return httpClient;
  }
  </code></pre>
  
  <p>}</p>
  
  <p>Quoting a statement from that tutorial :</p>
  
  <pre><code>On the client side, you simply need to distribute the signing certificate 
  with your app and validate against it.
  </code></pre>
  
  <p>On my web server, I have my own CA, which I created using open SSL, and used to sign certificates for different domain names that are used with my app.</p>
  
  <p>This statement indicates that this tutorial is meant for the CA certificate I have. I tested the code using ca.pem (from my CA's crt file) and it works fine.</p>
  
  <p>But I also tested the same code with a certificate I signed with that CA, e.g. server.pem ( from the signed server.crt), and still it works.</p>
  
  <p>Did I do something wrong, or is this code meant for pinning either :</p>
  
  <p>1) a CA certificate (covering all certificates signed by that CA) or </p>
  
  <p>2) a particular certificate (signed by some CA)  ?</p>