I just learned that some private keys leaked for a widely-trusted certificate authority. This is bad: it makes it possible for attackers to impersonate HTTPS services.
If you’re shipping a mobile app or service that uses OkHttp, you’re exposed to this problem until the host platform’s trusted roots list is patched. For Android and Java environments, that might take a very long time.
As an immediate workaround I’ve posted a gist for ForbiddenCertificatesInterceptor, which blocks the problematic certificates in the application layer. Install it as the last network interceptor in your chain.
val safeClient = client.newBuilder()
.addNetworkInterceptor(ForbiddenCertificatesInterceptor())
.build()You can use this with all supported versions of OkHttp.
In the next day or two we’ll ship updates to OkHttp that require no additional intervention.