Certificate Pinning on Android: OkHttp & Network Security Config

Certificate Pinning on Android: OkHttp & Network Security Config Certificate pinning protects against compromised CAs and man-in-the-middle attacks. Android provides two approaches: Network Security Configuration and OkHttp pinning. Network Security Config Approach Create network_security_config.xml : <?xml version="1.0" encoding="utf-8"?> <network-security-config> <domain-config> <domain includeSubdomains= "true" > example.com </domain> <pin-set> <pin digest= "SHA-256" > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= </pin> <pin digest= "SHA-256" > BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB= </pin> </pin-set> </domain-config> </network-security-config> Reference in AndroidManifest.xml: <application android:networkSecurityConfig= "@xml/network_security_config" > ... </application> OkHttp CertificatePinner val certificatePinner = CertificatePinner . Builder () . add ( "example.com" , "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" ) . add ( "example.com" , "sha256/BBBBBBBBBBBBBBBBBBB