SSL pinning using TrustKit with Alamofire in iOS - Swift

SSL pinning one of the popular ways to inspect HTTPS requests in iOS Apps is the Man-in-the-middle (MITM) attack. This involves having a trusted server’s keys add into your iOS app and some additional code to ensure that the app only communicates with servers using that particular certificate.

When SSL certificate pinning is active, the app will not allow any requests to be sent out to any untrusted server. Here I'm going to use TrustKit for SSL Key Pinning Handling. TrustKit Github

Let’s start to write Swift code to intercept SSL Pinning Alamofire Requests

TrustKit Configuration 

Deploying SSL pinning in the App requires initializing TrustKit with a pinning policy (domains, Subject Public Key Info hashes, and additional settings).

The policy can be configured within the App's Info.plist:

Alternatively, the pinning policy can be set programmatically: 

didFinishLaunchingWithOptions  in (AppDelegate)

After TrustKit has been initialized, a TSKPinningValidator instance can be retrieved from the TrustKit singleton and can be used to perform SSL pinning validation in the App's network delegates.

Setting network delegate in Alamofrie. 

When you are creating/requesting from makeRequestAlamofire will validate the Keys in Host side SSL pining and it will produce an error when key validation got failed.

If this code was helpful, I would love to hear from you or If you have any questions please post your comments below.