Certificate Pinning and Network Armor Script Builder

Role: Senior Android Financial Infrastructure Engineer specializing in network security, TLS enforcement, and MITM mitigation.

Context

• Core Banking Gateway Domain: {{bank_domain}}
• Primary SPKI SHA-256 Pin: {{primary_pin_hash}}
• Backup SPKI SHA-256 Pin: {{backup_pin_hash}}
• Security Telemetry Sink: {{telemetry_endpoint}}
• Proxy Enforcement Policy: {{proxy_policy_mode}}
• SIEM Alert Severity: {{alert_severity_level}}

Task

Produce an enterprise-grade OkHttp network configuration script and dynamic certificate pinning interceptor that prevents man-in-the-middle attacks, detects active reverse proxies, and reports pinning violations.

Method

1. Define the Android Network Security Configuration XML matching {{bank_domain}} with cleartext traffic completely disabled.
2. Initialize OkHttp CertificatePinner using {{primary_pin_hash}} and {{backup_pin_hash}} with explicit domain globbing.
3. Implement a custom network Interceptor inspecting system proxy settings based on {{proxy_policy_mode}}.
4. Build dynamic TLS 1.3 socket factory constraints enforcing modern cipher suites on legacy endpoints.
5. Implement an SSLPeerUnverifiedException handler that captures certificate chain details without logging raw bytes.
6. Format an asynchronous telemetry payload containing device time, TLS version, and violated host details.
7. Dispatch the incident event to {{telemetry_endpoint}} tagged with severity {{alert_severity_level}}.
8. Add fallback circuitry that terminates active HTTP connections when a proxy violation is detected.

Constraints

• The script MUST compile against modern OkHttp 4.x/5.x and Kotlin 1.9+.
• Developers MUST NOT allow cleartext HTTP fallback or accept self-signed user certificates.
• Telemetry reporting MUST NOT send user auth tokens, account numbers, or PII during error dispatch.
• Certificate validation MUST abort instantly if the primary and backup pins fail verification.

Output format

• Section 1: Android Manifest and Network Security Configuration (res/xml)
• Section 2: Complete OkHttp Network Client Script (Kotlin)
• Section 3: Telemetry Dispatcher and Proxy Guard Class
• Section 4: Unit Test Suite Mocking SSL Handshake Failures (JUnit5 + MockWebServer)

Self-review

• Ensure backup pin {{backup_pin_hash}} is included in both XML and OkHttp runtime configurations.
• Validate that no sensitive headers are mirrored into the {{telemetry_endpoint}} telemetry payload.
• Confirm proxy detection handles PAC (Proxy Auto-Config) and system HTTP proxy environment variables.