ikust/hello-pinnedcerts — pull request #5 by ikust (2014-07-12 14:17:05+00:00)
Title: Fixed certificate order of import in the keystore

Seems that in order for pinning to work on Android 2.3.x certificates need to be imported in the correct order to .bks keystore.

Certificates must be imported from the bottom of the certificate chain up to the root CA certificate. Also, important to note is that certificates must be imported under different aliases. Root CA certificate should be imported under "ca" alias.

Three .pem files have been added to the root of the repository as a convenience for experimenting:
* **github_api.pem** contains only the certificate for api.github.com.
* **digicert.pem** contains only parent DigiCert certificate of the previous one
* **ca.pem** contains root DigiCert CA certificate

In order to create keystore that will work on 2.3.x use following commands in that exact order:
```
keytool -importcert -v -trustcacerts -file "github_api.pem" -alias github -keystore "keystore.bks" -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "bcprov-jdk16-145.jar" -storetype BKS -storepass testing
keytool -importcert -v -trustcacerts -file "digicert.pem" -alias digicert -keystore "keystore.bks" -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "bcprov-jdk16-145.jar" -storetype BKS -storepass testing
keytool -importcert -v -trustcacerts -file "ca.pem" -alias ca -keystore "keystore.bks" -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "bcprov-jdk16-145.jar" -storetype BKS -storepass testing
```