SSL Pinning
Secure your API connections with SSL pinning
Overview
The Unveily SDK automatically applies SSL protection to all network communication. Developers do not need to configure anything separately.
| Protection | Description |
|---|---|
| HTTPS enforced | Blocks plain HTTP communication |
| Certificate validation | Automatically verifies server certificate validity |
| Dynamic pin update | Automatically reflects the latest pin info from the license server |
Development vs Production Environment
| Environment | Behavior |
|---|---|
| Debug build | Relaxed SSL validation mode (for development convenience) |
| Release build | Full SSL protection applied |
For production deployment, always use a release build (./gradlew bundleRelease). Debug builds have relaxed security validation and are not suitable for store distribution.
Customer Domain SSL
The web server that the WebView loads must also use HTTPS.
The remoteConfigUrl in config.json must also be HTTPS.
If an HTTP domain is used, loading will be blocked in the WebView.
Frequently Asked Questions
Q. Can I use a self-signed certificate?
Not supported in production builds. Use a certificate issued by a trusted Certificate Authority (CA) such as Let's Encrypt. Self-signed certificates can be tested in debug builds.
Q. I'm getting SSL-related errors.
- Check that your web server certificate is valid.
- Check if the certificate has expired.
- Check that intermediate certificates (Intermediate CA) are configured correctly.