certificate transparency

Author: Matthieu Gicquel

README.md

@@ -3,7 +3,7 @@
 <p align="center">Easily implement usual security measures in React Native Expo apps</p>
 
 - [SSL public key pinning](#ssl-pinning)
-- [🚧 Certificate transparency](#certificate-transparency)
+- [Certificate transparency](#certificate-transparency)
 - [🚧 "Recent screenshots" prevention](#recent-screenshots-prevention)
 
 > **⚠️ Disclaimer**<br/>
@@ -84,7 +84,14 @@ To test that SSL pinning is working as expected, you can:
 
 ## Certificate transparency
 
-TODO
+> **🥷 What's the threat?** Compromised certificate authorities. [More details](https://certificate.transparency.dev)
+
+- On iOS, [certificate transparency is enabled by default](https://developer.apple.com/documentation/ios-ipados-release-notes/ios-12_1_1-release-notes) since _iOS 12.1.1_
+- On Android, this package enables it using [appmatus/certificatetransparency](https://github.com/appmattus/certificatetransparency) for _Android >= 8.0_
+
+### Configuration
+
+None, enabled by default.
 
 ## "Recent screenshots" prevention
 

android/build.gradle

@@ -92,4 +92,5 @@ dependencies {
 
   // package-specific dependencies
   implementation("com.facebook.react:react-native:+")
+  implementation("com.appmattus.certificatetransparency:certificatetransparency-android:2.5+") // using `+` because minors are mostly automated updates of logs_list
 }

android/src/main/java/tech/bam/rnas/HttpClientOverride.kt

@@ -1,17 +1,24 @@
 package tech.bam.rnas
 
+import android.os.Build
 import com.facebook.react.modules.network.OkHttpClientFactory;
 import com.facebook.react.modules.network.OkHttpClientProvider;
 
 import okhttp3.CertificatePinner;
 import okhttp3.OkHttpClient;
 
+import com.appmattus.certificatetransparency.CTInterceptorBuilder
+
 import org.json.JSONObject
 
 public class SSLPinning : OkHttpClientFactory {
   override fun createNewNetworkModuleClient(): OkHttpClient {
     val config = parseConfig()
 
+    val clientBuilder = OkHttpClientProvider.createClientBuilder()
+
+    // -- SSL pinning --
+
     val certificatePinnerBuilder = CertificatePinner.Builder()
 
     for((hostName, certificates) in config) {
@@ -21,13 +28,19 @@ public class SSLPinning : OkHttpClientFactory {
       }
     }
 
-    val certificatePinner = certificatePinnerBuilder.build()
+    clientBuilder.certificatePinner(certificatePinnerBuilder.build())
 
-    val clientBuilder = OkHttpClientProvider.createClientBuilder()
+    // -- Certificate Transparency --
+
+    /*
+     * The library for certificate transparency does not support Android sdk version < 26 (Android 8.0) without setting up "desugaring"
+     * See more : https://github.com/appmattus/certificatetransparency#getting-started
+     */
+    if (Build.VERSION.SDK_INT >= 26) {
+      clientBuilder.addNetworkInterceptor(CTInterceptorBuilder().build())
+    }
 
-    return clientBuilder
-      .certificatePinner(certificatePinner)
-      .build()
+    return clientBuilder.build()
   }
 
 }
@@ -48,5 +61,5 @@ fun parseConfig() : Map<String, List<String>> {
       resultMap[key] = valuesList
   }
 
-  return resultMap // Map<String, List<String>>
+  return resultMap
 }