{"action":"created","issue":{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/3159","labels_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/3159/labels{/name}","comments_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/3159/comments","events_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/3159/events","html_url":"https://github.com/AFNetworking/AFNetworking/pull/3159","id":116796736,"number":3159,"title":"Fix certificate validation for servers providing incomplete chains","user":{"login":"p4checo","id":1391324,"avatar_url":"https://avatars.githubusercontent.com/u/1391324?v=3","gravatar_id":"","url":"https://api.github.com/users/p4checo","html_url":"https://github.com/p4checo","followers_url":"https://api.github.com/users/p4checo/followers","following_url":"https://api.github.com/users/p4checo/following{/other_user}","gists_url":"https://api.github.com/users/p4checo/gists{/gist_id}","starred_url":"https://api.github.com/users/p4checo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/p4checo/subscriptions","organizations_url":"https://api.github.com/users/p4checo/orgs","repos_url":"https://api.github.com/users/p4checo/repos","events_url":"https://api.github.com/users/p4checo/events{/privacy}","received_events_url":"https://api.github.com/users/p4checo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/labels/security","name":"security","color":"69B805"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/milestones/4","html_url":"https://github.com/AFNetworking/AFNetworking/milestones/3.0.0","labels_url":"https://api.github.com/repos/AFNetworking/AFNetworking/milestones/4/labels","id":1118316,"number":4,"title":"3.0.0","description":"AFNetworking 3.0.0 will remove support for NSURLConnection, feature a architecture for image downloading, and support tvOS, among other new features.","creator":{"login":"kcharwood","id":198768,"avatar_url":"https://avatars.githubusercontent.com/u/198768?v=3","gravatar_id":"","url":"https://api.github.com/users/kcharwood","html_url":"https://github.com/kcharwood","followers_url":"https://api.github.com/users/kcharwood/followers","following_url":"https://api.github.com/users/kcharwood/following{/other_user}","gists_url":"https://api.github.com/users/kcharwood/gists{/gist_id}","starred_url":"https://api.github.com/users/kcharwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kcharwood/subscriptions","organizations_url":"https://api.github.com/users/kcharwood/orgs","repos_url":"https://api.github.com/users/kcharwood/repos","events_url":"https://api.github.com/users/kcharwood/events{/privacy}","received_events_url":"https://api.github.com/users/kcharwood/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":18,"state":"open","created_at":"2015-05-19T14:12:08Z","updated_at":"2015-11-13T16:00:14Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-11-13T15:59:19Z","updated_at":"2015-11-13T17:19:36Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/pulls/3159","html_url":"https://github.com/AFNetworking/AFNetworking/pull/3159","diff_url":"https://github.com/AFNetworking/AFNetworking/pull/3159.diff","patch_url":"https://github.com/AFNetworking/AFNetworking/pull/3159.patch"},"body":"Some servers send incomplete certificate chains (without the Root CA), which\r\ncause issues in the latest version's (2.6.3) certificate pinning mechanism.\r\nIn these cases, when `AFSecurityPolicy`s `-evaluateServerTrust:` invokes\r\n`AFCertificateTrustChainForServerTrust(serverTrust)` (prior to setting the\r\nanchor), the Root CA isn't present (the server didn't send it). Afterwards,\r\neven though `AFServerTrustIsValid(serverTrust)` succeeds, the next validation\r\nfails since no pinned certificate matches any of the `serverCertificates`.\r\n\r\nBy fetching the `AFCertificateTrustChainForServerTrust(serverTrust)` *after*\r\nthe `AFServerTrustIsValid(serverTrust)` validation, the complete chain is\r\nobtained and the Root CAs match (pinned vs validated).\r\n\r\nA slight optimization was also made when validating if the `serverTrust`\r\ncertificates contain the `pinnedCertificates`, looping in reverse order and\r\nreturning after finding the first match.\r\n\r\nFollow up of PR #2921, but rebased for 3.0.0"},"comment":{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/comments/156492613","html_url":"https://github.com/AFNetworking/AFNetworking/pull/3159#issuecomment-156492613","issue_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/3159","id":156492613,"user":{"login":"kcharwood","id":198768,"avatar_url":"https://avatars.githubusercontent.com/u/198768?v=3","gravatar_id":"","url":"https://api.github.com/users/kcharwood","html_url":"https://github.com/kcharwood","followers_url":"https://api.github.com/users/kcharwood/followers","following_url":"https://api.github.com/users/kcharwood/following{/other_user}","gists_url":"https://api.github.com/users/kcharwood/gists{/gist_id}","starred_url":"https://api.github.com/users/kcharwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kcharwood/subscriptions","organizations_url":"https://api.github.com/users/kcharwood/orgs","repos_url":"https://api.github.com/users/kcharwood/repos","events_url":"https://api.github.com/users/kcharwood/events{/privacy}","received_events_url":"https://api.github.com/users/kcharwood/received_events","type":"User","site_admin":false},"created_at":"2015-11-13T17:19:36Z","updated_at":"2015-11-13T17:19:36Z","body":"Are there any negative tests we should consider here? "}}