ios – SSL Pinning NSPinnedCAIdentities in NSAppTransportSecurity doesn’t work in WebView Flutter


I’m using certificates for WebView payment form in Flutter. Got 2 sha prints like this:

<key>NSAppTransportSecurity</key>
        <dict>
            <key>NSPinnedDomains</key>
            <dict>
                <key>-DOMAIN-</key>
                <dict>
                    <key>NSIncludesSubdomains</key>
                    <true />
                    <key>NSPinnedCAIdentities</key>
                    <array>
                        <dict>
                            <key>SPKI-SHA256-BASE64</key>
                            <string>BEeqSxjEi56NsW6RgJKG3Sfv1qULqA0whOuecLqOHco=</string>
                        </dict>
                        <dict>
                            <key>SPKI-SHA256-BASE64</key>
                            <string>XogjHSnLsowNRsJF5/eHMvU2LmHy/7wmNXkhn7gBQyg=</string>
                        </dict>
                    </array>
                </dict>
            </dict>
        </dict>

Attemption to load in returns error:

  • Flutter: An SSL error has occurred and a secure connection to the server cannot be made
  • XCode: no SSL errors

How to fix this? I’ve used official docs for SSL pinning. Everything seems fine, certificates valid

UPD: using

    <key>NSAllowsArbitraryLoadsInWebContent</key>
    <true />

as temporary solution doesn’t work and debugger returns second error:

The certificate for this server is invalid. You might be connecting to a server that is pretending to be “--domain--” which could put your confidential information at risk.

but I’ve already added certificate just from this domain

Latest articles

spot_imgspot_img

Related articles

Leave a reply

Please enter your comment!
Please enter your name here

spot_imgspot_img