chain-engineering/chain-ios — pull request #16 by oleganza (2014-11-27 14:52:15+00:00)
Title: Certificate anchoring for websockets

While adding support for anchor certificates (issue #12) I noticed a few things:

1. Server ws.chain.com uses a different root certificate than api.chain.com. To make sure websockets lib validates certificate correctly, I had to add another root certificate to the list of trusted anchors. For simplicity, this second anchor goes to a common list of anchors. **This has a security implication now: either for these two root certificates now authenticate HTTPS connection.** Maybe it's not a big deal since both are issued by the same organization (DigiCert Inc), but that must be considered carefully.

2. SocketRocket guy was not responsive to my patch yet, but I'd like to ship anchored support ASAP and also explore how can we avoid being blocked by third party developers in this and similar cases in the future. So I submitted them a nice pull request, but I also made a branch on which I renamed all exported symbols to use prefix "Chain*" so we can use the new feature right away. I did not simply publish this as an alternatively named pod (e.g. ChainSocketRocket) because then it would conflict with real SocketRocket sources if the user of Chain library would happen to use SocketRocket pod for some other reasons. Our reliance on this SocketRocket fork is very minimal and we can easily move back to original SocketRocket whenever they update it.