SSL pinning on Ionic Android using ionic advanced http

= How to get the Certificate
1. Open the API website using chrome
2. View Site Information (Lock button behind url address)
3. Certificate
4. Tab Details
5. Public Key
6. Copy to File
7. Choose DER ENCODED format MUST!!
8. Finish

Get Yanki Pranata’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

= How to implement the Certificate to Ionic Project
1. Copy the Cert file to /platform/android/assets/
- If the assets folder not exist, just create the folder
2. Copy the Cert file to /src/assets/certificates/
3. In config.xml add this in <platform name=”android”>

<resource-file src="src/assets/certificates/your_certificate.cer" target="app/src/main/assets/www/certificates/your_certificate.cer" />

4. In angular.json add this in

"project" : {
              "app" : {
                ...,
                "architect" : {
                  "build" : {
                    "options" : {
                      "assets" : [
                        ...,
                        {
                          "glob": "**/*", 
                          "input": "src/assets/certificates",    
                          "output": "certificates"
                        }
                      ]
                    }
                  }
                }
              }
            }

5. Delete the /www folder
6. ionic cordova prepare android
7. check if in /www folder if the /www/certificates/your_certificate.cer exist or not
8. add this line of code, in app.component.ts when platform is ready

cordova.plugin.http.setServerTrustMode('pinned', function() {
    console.log('success enable SSL pinning');
}, function() {
    console.log('error enable SSL pinning');
});

9. Finish

• How to check if you implement it correctly or not ?
  You only can call API that using the same certificate, so just find any dummy API in the internet and try to enable the SSL Pinning you shouldn’t be able to call the dummy API, if you turn it off, you can call both API, your API and the dummy API
• Can you add multiple cert ?
  Sure you can add multiple cert, just copy all the cert to the src/assets/certificates & /platform/android/assets

refer : https://github.com/silkimen/cordova-plugin-advanced-http#setservertrustmode