[No QA] Update certificate pins for NewDot - #96722
Conversation
|
@thelullabyy Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button] |
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3b8e663406
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "XPujjYNyJh3N+7AgvBfcVXaEl1IhDB1OdoL6t+4bhbQ=", | ||
| "kIdp6NNEd8wsugYyyIYFsi1ylMCED3hZbSR8ZFsa/A4=", |
There was a problem hiding this comment.
Changing the canonical pin set here without also moving the Mobile-Expensify gitlink (it is unchanged in this commit) leaves the HybridApp mobile build on the previous TrustKit/OkHttp pin lists; the certificate-pinning README documents those Mobile-Expensify files as the sources used by production/TestFlight HybridApp traffic. In that context, the July 7 CA migration will still produce monitor-mode pinning failures/noisy Sentry events for mobile users, and it would block traffic if enforcement is flipped later, even though the App-side pins are current. Please update or link the corresponding Mobile-Expensify pin rotation with this change.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
The Mobile-Expensify PR is up: https://github.com/Expensify/Mobile-Expensify/pull/14024
|
Do I need to review this PR? @staszekscp |
|
No product review needed. |
|
Conflict resolved! |
|
Hi @staszekscp, please let me know if it requires review from my side. Thanks |
|
I'll fix the problem tomorrow in the morning and I'll let you know when it's ready to be re-reviewed! But it's just equivalent of the Mobile-Expensify PR that is now on prod! |
|
@thelullabyy I think it's ready! |
|
Thanks. It is on my list today... |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 43a91a6835
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| { | ||
| "_comment": "Canonical source of truth for SSL certificate pins (Iteration 1 - NewDot). Regenerate with scripts/generateCertificatePins.sh. Each domain pins the leaf SPKI hash (primary) and its issuing intermediate CA SPKI hash (durable backup that survives leaf rotation). Hashes are base64-encoded SHA-256 of the Subject Public Key Info. Native code (Android network_security_config_enforce.xml, Android OkHttpClientFactory, Android NitroFetch Cronet, iOS TrustKit) MUST be kept in sync with this file - the generation script prints the values for each target.", | ||
| "_lastGenerated": "2026-06-03", | ||
| "_comment": "Canonical source of truth for SSL certificate pins (Iteration 1 - NewDot). Regenerate with scripts/generateCertificatePins.sh. Cloudflare-fronted expensify.com hosts (Groups A & B: www/secure/staging/staging-secure/new/staging.new) pin the SPKI of the ROOT of every CA Cloudflare may use for them - Let's Encrypt (ISRG Root X1/X2), Google Trust Services (GTS Root R1-R4) and SSL.com (TLS ECC/RSA Root CA 2022) - plus each CA's live issuing intermediate, so the app survives leaf rotation, intermediate rotation, and a switch between those CAs without an emergency release. Other hosts pin the leaf SPKI (primary) and its issuing intermediate CA SPKI (durable backup). Hashes are base64-encoded SHA-256 of the Subject Public Key Info. Native code (Android network_security_config_enforce.xml, Android CertificatePinning.kt, iOS CertificatePinning.swift) and the Mobile-Expensify HybridApp files MUST be kept in sync with this file.", |
There was a problem hiding this comment.
This canonical pin rotation leaves the NitroFetch/Cronet pin set unchanged; patches/react-native-nitro-fetch+1.5.4.patch still pins the old Group A/Group B leaf hashes at lines 67-73, and that patch explicitly says Cronet does not honor Android's network_security_config. For Android requests routed through NitroFetch/Cronet, a Cloudflare switch to a chain outside those old pins will still generate monitor-mode pin failures and would block traffic once enforce mode is enabled, even though the App-side OkHttp/iOS pins were updated. Please mirror the new Cloudflare pin set in the NitroFetch patch too.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fair point, I'm preparing a commit with the improvement!
|
Ok, we should be good now |
|
Hey @thelullabyy! 👋🏻 Kind bump here :) |
|
Rechecking... hope that I can be approved today |
|
Changes LGTM. I rebuilded local and it doesn't encounter any issues. However, I think we need run adhoc build to test it. Requesting https://expensify.slack.com/archives/C02NK2DQWUX/p1786990877812559 |
4 participants
Explanation of Change
Updates certificate pins for
expensify.comFixed Issues
$ https://github.com/Expensify/Expensify/issues/633469
PROPOSAL:
Tests
Offline tests
QA Steps
N/A
PR Author Checklist
### Fixed Issuessection aboveTestssectionOffline stepssectionQA stepssectionAvatar, I verified the components usingAvatarare working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))npm run compress-svg)Avataris modified, I verified thatAvataris working as expected in all cases)Designlabel and/or tagged@Expensify/designso the design team can review the changes.mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps.Screenshots/Videos
Android: Native
Android: mWeb Chrome
iOS: Native
iOS: mWeb Safari
MacOS: Chrome / Safari