Add public key pinning

[rumpelsepp]

Support for public key pinning is missing. curl has PINNEDPUBLICKEY.

[stephanbuys]

Some more reference material: https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning

There’s an OpenSSL example in there. If given a pointer or two I’d be happy to try implement this.

[remram44]

Currently reqwest also does not work if a certificate store is not available on the system, even if the correct certificate has been added with .add_root_certificate() (or a public key is pinned). Running without a certificate store should probably also be supported as pinning methods get added.

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Error(Hyper(Error(Connect, Custom { kind: Other, error: Ssl(Error { code: ErrorCode(1), cause: Some(Ssl(ErrorStack([Error { code: 337047686, library: "SSL routines", function: "tls_process_server_certificate", reason: "certificate verify failed", file: "ssl/statem/statem_clnt.c", line: 1921 }]))) }, X509VerifyResult { code: 20, error: "unable to get local issuer certificate" }) })), "https://example.com/")', src/libcore/result.rs:1084:5

[goodidea-kp]

any activity on this? I have the same prolem...

[zumoshi]

Doesn't #1150 fix this?
using add_root_certificate and tls_built_in_root_certs should create the desired behavior unless I misunderstood what the issue is about.

[yuvalmarciano]

Hi, any news here?

[Tienisto]

Doesn't #1150 fix this? using add_root_certificate and tls_built_in_root_certs should create the desired behavior unless I misunderstood what the issue is about.

No, add_root_certificate is much more strict because it only allows adding a root certificate. I just tried to put only the leaf certificate there, and the connection got rejected.

Furthermore, I would like to supply the sha256 of the leaf certificate instead of providing the full certificate (chain)

[lucacastelnuovo]

What would be needed for this issue to be moved from label B-rfc (Blocked Request for comments. More discussion would help move this along.) to E-*?

[seanmonstar]

It'd need more of a specced out design. Likely someone else motivated to consider how exactly it would work, and then to implemented it. Some things to consider:

• What does the method and arguments look like?
• Does it work with all TLS backends?