Android SSL Pinning(防止中间人攻击)

为了防止中间人攻击，我们需要证书固定技术。
https://developer.android.com/training/articles/security-ssl.html#Pinning

通过名称为证书固定的技术，应用可以更好地保护自己免受以欺诈方式发放的证书的攻击。这里基本上使用上面未知 CA 案例中提供的示例，将应用的可信 CA 限制在一个很小的 CA 集范围内，应用的服务器将使用这个集合。这样可以防止因泄露系统中其他 100 多个 CA 中的某个 CA 而破坏应用安全通道。

项目中使用了Okhttp，在OKhttp中实现SSL Pinning是十分简单的

Certificate Pinning

By default, OkHttp trusts the certificate authorities of the host platform. This strategy maximizes connectivity, but it is subject to certificate authority attacks such as the 2011 DigiNotar attack. It also assumes your HTTPS servers’ certificates are signed by a certificate authority.

Use CertificatePinner to restrict which certificates and certificate authorities are trusted. Certificate pinning increases security, but limits your server team’s abilities to update their TLS certificates. Do not use certificate pinning without the blessing of your server’s TLS administrator!

  public CertificatePinning() {
    client = new OkHttpClient.Builder()
        .certificatePinner(new CertificatePinner.Builder()
            .add("publicobject.com", "sha256/afwiKY3RxoMmLkuRW1l7QsPZTJPwDS2pdDROQjXw8ig=")
            .build())
        .build();
  }

  public void run() throws Exception {
    Request request = new Request.Builder()
        .url("https://publicobject.com/robots.txt")
        .build();

    Response response = client.newCall(request).execute();
    if (!response.isSuccessful()) throw new IOException("Unexpected code " + response);

    for (Certificate certificate : response.handshake().peerCertificates()) {
      System.out.println(CertificatePinner.pin(certificate));
    }
  }

另外从Android 24起，支持SSL Pinning是一件十分简单的事情，在AndroidManifest.xml file中指定你的configuration file

    
        appmattus.com
        
            4hw5tz+scE+TW+mlai5YipDfFWn1dqvfLG+nU7tq1V8=
            YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=
        
    

更多集成方式（Retrofit / Picasso / Volley）请参考:
Android Security: SSL Pinning