[MOD-2347] [appcelerator.https] iOS/Android: Add option to pin to CA instead of leaf

   
   var https = require('appcelerator.https');
   
   /*
    * Create a Security Manager for Titanium.Network.HTTPClient that
    * authenticates a currated set of HTTPS servers. It does this by
    * "pinning" an HTTPS server's DNS name to the public key contained in
    * the X509 certificate it uses for TLS communication. The public key
    * is embedded in an app by adding this X509 certificate to the app's
    * Resources directory.
    *
    * With such a "pin" in place, the security manager will guarantee
    * that all HTTPClient connections to this HTTPS server are to a
    * server that holds the private key corresponding to the public key
    * embedded in the app, therefore authenticating the server.
    *
    * This is what prevents "Man-in-the-Middle" attack.
    *
    * This example pins two URLs.
    *
    * The first URL, https://www.americanexpress.com, is pinned to the
    * public key in the X.509 certificate in the file named
    * wellsfargo.cer. This is intentionally an incorrect configuration.
    * Connections to https://www.americanexpress.com must fail since the
    * public key presented by the host will not match the configuration of the
    * security manager
    *
    * The second URL, https://www.wellsfargo.com, is pinned to the public
    * key in the X.509 certificate in the file named
    * wellsfargo.cer. This is configured correctly. Connections to
    * https://www.wellsfargo.com must succeed. Note that these request redirect.
    * The redirected request is not handled by the security manager since it is
    * not configured but will succeed if the system is able to validate the
    * certificate chain presented by the redirected host.
    *
    * The X.509 certificate files can have any name and extension you
    * wish, but they must be in the standard DER binary format.
    */
   var securityManager = https.createX509CertificatePinningSecurityManager([{
   	url: "https://www.wellsfargo.com",
   	serverCertificate: "wellsfargo.cer",
   	trustChainIndex: 1 // 2nd certificate in the cert-chain (Symantec Class 3 Secure Server CA)
   }]);
   
   var win = Titanium.UI.createWindow({
   	title: 'Pin Example',
   	backgroundColor: 'white'
   });
   
   var view = Ti.UI.createView({
   	backgroundColor: 'white',
   	layout: 'vertical',
   	width: Ti.UI.SIZE,
   	height: Ti.UI.SIZE,
   	top:20
   });
   
   var button1 = Titanium.UI.createButton({
   	title: 'Load wellsfargo',
   	color: 'green',
   	top:20,
   });
   
   var label1 = Titanium.UI.createLabel({
   	text: 'Desc:',
   	color: 'black',
   	top:20,
   });
   
   var label2 = Titanium.UI.createLabel({
   	text: 'Status:',
   	color: 'black',
   	top:20,
   });
   
   view.add(button1);
   view.add(label1);
   view.add(label2);
   
   win.add(view);
   win.open();
   
   /*
    * Create an HTTP client the same way you always have, but pass in an
    * (optional) Security Manager. In this example, we pass in the
    * "Certificate Pinning Security Manager " that I configured above.
    */
   function getXHR(url) {
   	var xhr = Ti.Network.createHTTPClient({
   		onload: function(e) {
   			label2.text = 'onload called. Request succeeded';
   		},
   		onerror: function(e) {
   			label2.text = 'onerror called. Request failed.';
   		},
   		timeout : 30000,
   		securityManager: securityManager
   	});
   
   	xhr.open('GET',url);
   
   	return xhr;
   }
   
   var wf = "https://www.wellsfargo.com";
   
   button1.addEventListener('click',function(e){
   	var xhr = getXHR(wf);
   	label1.text = 'SecurityManager is configured correctly for this request. Request must succeed. ';
   	label1.color = 'green';
   	label2.text = 'Desc:';
   	xhr.send();
   });
   

   	{
   		url: "https://www.wellsfargo.com",
   		serverCertificate: "wellsfargo.cer",
                   trustChainIndex: 1 // 2nd certificate in certificate chain
   	}
   

       SMTP error from remote mail server after pipelined end of data:
       552-5.7.0 This message was blocked because its content presents a potential
       552-5.7.0 security issue. Please visit
       552-5.7.0  https://support.google.com/mail/?p=BlockedMessage to review our
       552 5.7.0 message content and attachment content guidelines. f22si13471345wrf.172 - gsmtp
    Reporting-MTA: dns; smtprelay04.ispgateway.de
    

    2017-10-21 13:42:54.092 test_https[4421:133780] 0: <cert(0x7fe9e9d25310) s: www.wellsfargo.com i: Symantec Class 3 Secure Server CA - G4>
    2017-10-21 13:42:59.994 test_https[4421:133780] 1: <cert(0x7fe9ea03f800) s: Symantec Class 3 Secure Server CA - G4 i: VeriSign Class 3 Public Primary Certification Authority - G5>
    2017-10-21 13:43:04.133 test_https[4421:133780] 2: <cert(0x7fe9ea063a00) s: VeriSign Class 3 Public Primary Certification Authority - G5 i: VeriSign Class 3 Public Primary Certification Authority - G5>