{"action":"created","issue":{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/2744","labels_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/2744/labels{/name}","comments_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/2744/comments","events_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/2744/events","html_url":"https://github.com/AFNetworking/AFNetworking/issues/2744","id":79486361,"number":2744,"title":"SSL Pinning: What Should Be Certificate Chain Validation Expected Behavior?","user":{"login":"kcharwood","id":198768,"avatar_url":"https://avatars.githubusercontent.com/u/198768?v=3","gravatar_id":"","url":"https://api.github.com/users/kcharwood","html_url":"https://github.com/kcharwood","followers_url":"https://api.github.com/users/kcharwood/followers","following_url":"https://api.github.com/users/kcharwood/following{/other_user}","gists_url":"https://api.github.com/users/kcharwood/gists{/gist_id}","starred_url":"https://api.github.com/users/kcharwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kcharwood/subscriptions","organizations_url":"https://api.github.com/users/kcharwood/orgs","repos_url":"https://api.github.com/users/kcharwood/repos","events_url":"https://api.github.com/users/kcharwood/events{/privacy}","received_events_url":"https://api.github.com/users/kcharwood/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/labels/needs%20feedback","name":"needs feedback","color":"9559F0"},{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/labels/security","name":"security","color":"69B805"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-05-22T14:57:22Z","updated_at":"2015-05-28T15:52:53Z","closed_at":null,"body":"I've been spending some time deep in the `AFSecurityPolicy` class lately, and I'm wanting to get some feedback from the AFNetworking community on what the various needs are out there.\r\n\r\nIn AFNetworking, you can currently either pin against the leaf certificate, or the entire chain itself. There is no way to pin against only an intermediate certificate (B in the diagram below), or a subset of the chain (A and B in the diagram below). It's my understanding that there are some people who would want to only pin against an intermediate certificate, or a subset of chain, to allow for production/development certs, and the exchange of new certificates, while limiting the scope of authenticated connections to only be from the intermediate chain.\r\n\r\n* A (root)\r\n   * B\r\n      * C (leaf)\r\n\r\nThe big question: **Is this something worth supporting?** Are there any major security cons to this approach?\r\n\r\nFollow up question: **Should you be able to provide multiple pinning chains to check against?** For example, in #2733 there is the concept of providing a backup key should one be needed in the future. Would it make sense to expose a backup chain, and allow the developer to provide multiple valid chains to check (essentially ORing them together?) That could potentially make dev server/production server management a bit easier as well."},"comment":{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/comments/106437326","html_url":"https://github.com/AFNetworking/AFNetworking/issues/2744#issuecomment-106437326","issue_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/2744","id":106437326,"user":{"login":"arein","id":966091,"avatar_url":"https://avatars.githubusercontent.com/u/966091?v=3","gravatar_id":"","url":"https://api.github.com/users/arein","html_url":"https://github.com/arein","followers_url":"https://api.github.com/users/arein/followers","following_url":"https://api.github.com/users/arein/following{/other_user}","gists_url":"https://api.github.com/users/arein/gists{/gist_id}","starred_url":"https://api.github.com/users/arein/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arein/subscriptions","organizations_url":"https://api.github.com/users/arein/orgs","repos_url":"https://api.github.com/users/arein/repos","events_url":"https://api.github.com/users/arein/events{/privacy}","received_events_url":"https://api.github.com/users/arein/received_events","type":"User","site_admin":false},"created_at":"2015-05-28T15:52:53Z","updated_at":"2015-05-28T15:52:53Z","body":"@OliverLetterer: Thanks!\r\n\r\nAbout Public Key Pinning: As far as I understand it is best practice to pin not just the public key but the SPKI (see [Adam's blog post](http://goo.gl/AIx3e5)). This is also how Chromium is implemented.\r\n\r\nAm I right that this does not provide any security benefit when  `validatesDomainName` is set to `YES` as the domain name is already validated?"}}