This package manages TLS certificate pinning in react-native for Android and iOS.
$ npm install react-native-cert-pinner --save
Mostly automatic installation
$ react-native link react-native-cert-pinner
Add the following line to the project targets in your
pod 'TrustKit', '~> 1.4.2'
Then run pod install.
- Open up
import com.criticalblue.reactnative.CertPinnerPackage;to the imports at the top of the file
new CertPinnerPackage()to the list returned by the
- Append the following lines to
include ':react-native-cert-pinner' project(':react-native-cert-pinner').projectDir = new File(rootProject.projectDir, '../node_modules/react-native-cert-pinner/android')
- Insert the following lines inside the dependencies block in
To use the react-native networking utilities, like
Certificate Pinning Configuration
pinset utility is provided to help configure the native modules for pinning.
The default setup assumes you are running in your project's home directory. The default configuration file is
./pinset.json, and the default native android project is assumed to be located at
./android. Both these locations may be overriden on the command line.
To get help:
$ npx pinset -h pinset [command] [options] init ..... initialize pinset configuration gen ...... generate pinset configuration version .. show package version help ..... show help menu for a command
or for a sub-command:
$ npx pinset help gen pinset gen [options] [config] --android, -a <path> .. path to Android project (defaults to './android') --ios, -i <path> ...... path to iOS project (defaults to './ios') --force, -f ........... always overwrite existing configuration config ................ configuration file - defaults to 'pinset.json'
The first step is to generate a starter configuration:
$ npx pinset init
This command will not overwrite an existing configuration file unless the
--force flag is used.
Next, determine which URLs you want to pin, and determine each certificate's public key hash. A convenient utility is provided by Report URI at https://report-uri.com/home/pkp_hash. Enter a URL to see the current chain of certificate hashes.
Enter the desired public key hashes into the
Domains starting with
*. will include all subdomains.
It is recommended to select multiple hashes with at least one of them being from an intermediate certificate.
Once the configuration is set, generate the native project sources:
$ npx pinset gen Reading config file './pinset.json'. Updating java file './android/app/src/main/java/com/criticalblue/reactnative/GeneratedCertificatePinner.java'. Updating plist file './ios/example/info.plist'.
Build and run the react-native app, for example:
$ react-native run-ios
To update the certificate pins, edit the configuration file, regenerate the native sources, and rebuild the app.
If you consider publishing hashes of public key certificates to be a security breach, you may want to remove or ignore the pinset configuration and generated fines from your repository.
To ignore the default files in a git repository, add to
# default configuration file ./pinset.json # default generated android source ./android/app/src/main/java/com/criticalblue/reactnative/GeneratedCertificatePinner.java ./ios/<your project here>/info.plist
- Automatically regenerate native source files whenever the pin set configuration changes.
- Add source regeneration and git ignores to the mostly automatic react-native linking step.
- Add certificate lookup to the
- Better secure pinset information within the app.