Option to not enforce Certificate pinning

I am using Okhttp + Retrofit for networking in my SDK. I have a requirement to implement Certificate pinning but not enforce it. We just need to get the failure reports for pinning failure and would like the connection to go through for now during the monitoring period. TrustKit is another Certificate pinning library which provides this option to set enforce = false. With this, the connection itself wouldn’t fail but we can get the failure reports.

I do not see a way to achieve similar behavior using the Okhttp CertificatePinner. Are there any plans to add this functionality? Or do you have any suggestions on how I can achieve this behavior using the existing functionality?

Would have been easier if we could extend CertificatePinner class and override check() ?

Thanks in advance.

[shenoymukesh]

@yschimke Does below code make sense?

`

class CustomCertCheckInterceptor(val certificatePinner: CertificatePinner) : Interceptor {

override fun intercept(chain: Interceptor.Chain): Response {
    val host = chain.request().url.host
    val certs = chain.connection()?.handshake()?.peerCertificates ?: emptyList()

    try {
        certificatePinner.check(host, certs)
    } catch (e: SSLPeerUnverifiedException) {
        //Do the logging and reporting for pinning failure
    }
    return chain.proceed(chain.request())
}

}

`

[yschimke]

@shenoymukesh The point of putting the question on stackoverflow is to use that for discussion, and not continuing the noise to other developers here. Closing this discussion. Please reply there.