Keyservers: Dont follow redirects, pin pgp.mit.edu, check for pinned cert on add (OKC-01-018)

1 files changed, 5 insertions, 1 deletions

diff --git a/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/keyimport/HkpKeyserver.java b/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/keyimport/HkpKeyserver.java
index 558b8ce7d..5683decdf 100644
--- a/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/keyimport/HkpKeyserver.java
+++ b/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/keyimport/HkpKeyserver.java
@@ -204,11 +204,15 @@ public class HkpKeyserver extends Keyserver {
         OkHttpClient client = new OkHttpClient();
 
         try {
-            TlsHelper.pinCertificateIfNecessary(client, url);
+            TlsHelper.usePinnedCertificateIfAvailable(client, url);
         } catch (TlsHelper.TlsHelperException e) {
             Log.w(Constants.TAG, e);
         }
 
+        // don't follow any redirects
+        client.setFollowRedirects(false);
+        client.setFollowSslRedirects(false);
+
         if (proxy != null) {
             client.setProxy(proxy);
             client.setConnectTimeout(30000, TimeUnit.MILLISECONDS);